CVE-2014-9358

MEDIUM6.5EPSS 0.35%

Directory Traversal in Docker in github.com/docker/docker

發布日:2022/2/15修改日:2026/4/28

也稱為:DEBIAN-CVE-2014-9358

描述

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

受影響套件(3)

Debian/docker.iofrom 0, < 1.3.3~dfsg1-1
Go/github.com/docker/dockerfrom 0, < 1.3.2
Go/github.com/docker/dockerfrom 0, < 1.3.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

參考連結(9)

ADVISORYhttps://github.com/advisories/GHSA-qmmc-jppf-32wv
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-9358
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-9358
WEBhttps://access.redhat.com/security/cve/cve-2014-9358
WEBhttps://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
WEBhttps://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ
WEBhttps://groups.google.com/g/docker-user/c/nFAz-B-n4Bw/m/0wr3wvLsnUwJ
WEBhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9358
WEBhttp://www.securityfocus.com/archive/1/534215/100/0/threaded