CVE-2020-27534: Path Traversal
util/binfmtmisc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
Other sources
util/binfmtmisc/check.go in moby buildkit calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27534?
CVE-2020-27534 is a vulnerability in Docker Engine before version 19.03.9 that could potentially allow an attacker to construct a potentially unsafe temporary pathname.
What is the severity of CVE-2020-27534?
The severity of CVE-2020-27534 is medium, with a severity value of 5.3.
Which software versions are affected by CVE-2020-27534?
Docker Engine versions up to, but excluding, 19.03.9 are affected by CVE-2020-27534.
How can I fix CVE-2020-27534?
To fix CVE-2020-27534, it is recommended to update Docker Engine to version 19.03.9 or newer.
Where can I find more information about CVE-2020-27534?
More information about CVE-2020-27534 can be found in the Docker Engine release notes and the GitHub pull requests related to this vulnerability.