REDHAT-BUG-1714722: Medium severity Docker vulnerability
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
References: https://seclists.org/oss-sec/2019/q2/131 https://bugzilla.suse.com/showbug.cgi?id=1096726 https://bugzilla.novell.com/showbug.cgi?id=1096726
Upstream Patch: https://github.com/docker/docker/pull/39252 https://github.com/docker/docker/pull/5720 https://github.com/docker/docker/pull/6000
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
docker/dockerto a version that resolves this vulnerability.Patch 39252 - Upgrade
Upgrade
docker/dockerto a version that resolves this vulnerability.Patch 5720 - Upgrade
Upgrade
docker/dockerto a version that resolves this vulnerability.Patch 6000
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1714722?
The severity of REDHAT-BUG-1714722 is critical due to its potential for arbitrary read-write access to the host filesystem with root privileges.
How do I fix REDHAT-BUG-1714722?
To fix REDHAT-BUG-1714722, upgrade Docker to a version later than 18.06.1-ce-rc2 where the vulnerability is patched.
What systems are affected by REDHAT-BUG-1714722?
The systems affected by REDHAT-BUG-1714722 include Docker versions up to and including 18.06.1-ce-rc2.
What type of attack does REDHAT-BUG-1714722 involve?
REDHAT-BUG-1714722 involves a symlink-exchange attack coupled with directory traversal.
What are the implications of REDHAT-BUG-1714722?
The implications of REDHAT-BUG-1714722 include serious security risks as attackers can gain unauthorized access and control over the host filesystem.