CVE-2018-15664
23.05.2019, 14:29
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| docker | docker | 17.06.0-ce |
| docker | docker | 17.06.0-ce:rc1 |
| docker | docker | 17.06.0-ce:rc2 |
| docker | docker | 17.06.0-ce:rc3 |
| docker | docker | 17.06.0-ce:rc4 |
| docker | docker | 17.06.0-ce:rc5 |
| docker | docker | 17.06.1-ce |
| docker | docker | 17.06.1-ce:rc1 |
| docker | docker | 17.06.1-ce:rc2 |
| docker | docker | 17.06.1-ce:rc3 |
| docker | docker | 17.06.1-ce:rc4 |
| docker | docker | 17.06.2-ce |
| docker | docker | 17.06.2-ce:rc1 |
| docker | docker | 17.07.0-ce |
| docker | docker | 17.07.0-ce:rc1 |
| docker | docker | 17.07.0-ce:rc2 |
| docker | docker | 17.07.0-ce:rc3 |
| docker | docker | 17.07.0-ce:rc4 |
| docker | docker | 17.09.0-ce |
| docker | docker | 17.09.0-ce:rc1 |
| docker | docker | 17.09.0-ce:rc2 |
| docker | docker | 17.09.0-ce:rc3 |
| docker | docker | 17.09.1-ce |
| docker | docker | 17.09.1-ce-:rc1 |
| docker | docker | 17.10.0-ce |
| docker | docker | 17.10.0-ce:rc1 |
| docker | docker | 17.10.0-ce:rc2 |
| docker | docker | 17.11.0-ce |
| docker | docker | 17.11.0-ce:rc1 |
| docker | docker | 17.11.0-ce:rc2 |
| docker | docker | 17.11.0-ce:rc3 |
| docker | docker | 17.11.0-ce:rc4 |
| docker | docker | 17.12.0-ce |
| docker | docker | 17.12.0-ce:rc1 |
| docker | docker | 17.12.0-ce:rc2 |
| docker | docker | 17.12.0-ce:rc3 |
| docker | docker | 17.12.0-ce:rc4 |
| docker | docker | 17.12.1-ce |
| docker | docker | 17.12.1-ce:rc1 |
| docker | docker | 17.12.1-ce:rc2 |
| docker | docker | 18.01.0-ce |
| docker | docker | 18.01.0-ce:rc1 |
| docker | docker | 18.02.0-ce |
| docker | docker | 18.02.0-ce:rc1 |
| docker | docker | 18.02.0-ce:rc2 |
| docker | docker | 18.03.0-ce |
| docker | docker | 18.03.0-ce:rc1 |
| docker | docker | 18.03.0-ce:rc2 |
| docker | docker | 18.03.0-ce:rc3 |
| docker | docker | 18.03.0-ce:rc4 |
| docker | docker | 18.03.1-ce |
| docker | docker | 18.03.1-ce:rc1 |
| docker | docker | 18.03.1-ce:rc2 |
| docker | docker | 18.04.0-ce |
| docker | docker | 18.04.0-ce:rc1 |
| docker | docker | 18.04.0-ce:rc2 |
| docker | docker | 18.05.0-ce |
| docker | docker | 18.05.0-ce:rc1 |
| docker | docker | 18.06.0-ce |
| docker | docker | 18.06.0-ce:rc1 |
| docker | docker | 18.06.0-ce:rc2 |
| docker | docker | 18.06.0-ce:rc3 |
| docker | docker | 18.06.1-ce:rc1 |
| docker | docker | 18.06.1-ce:rc2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fuse-overlayfs |
| ||||||||||||||||||||||||||||
| fuse3 |
| ||||||||||||||||||||||||||||
| libcontainers-common-20190401 |
| ||||||||||||||||||||||||||||
| libcontainers-common-20240408 |
| ||||||||||||||||||||||||||||
| libcontainers-default-policy-20240408 |
| ||||||||||||||||||||||||||||
| libcontainers-sles-mounts-20240408 |
| ||||||||||||||||||||||||||||
| libfuse3-3 |
| ||||||||||||||||||||||||||||
| podman |
| ||||||||||||||||||||||||||||
| podman-cni-config |
| ||||||||||||||||||||||||||||
| registries-conf-default-20240408 |
| ||||||||||||||||||||||||||||
| registries-conf-suse-20240408 |
| ||||||||||||||||||||||||||||
| slirp4netns |
|
References