CVE-2018-15664
23.05.2019, 14:29
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
| Vendor | Product | Version |
|---|---|---|
| docker | docker | 17.06.0-ce |
| docker | docker | 17.06.0-ce:rc1 |
| docker | docker | 17.06.0-ce:rc2 |
| docker | docker | 17.06.0-ce:rc3 |
| docker | docker | 17.06.0-ce:rc4 |
| docker | docker | 17.06.0-ce:rc5 |
| docker | docker | 17.06.1-ce |
| docker | docker | 17.06.1-ce:rc1 |
| docker | docker | 17.06.1-ce:rc2 |
| docker | docker | 17.06.1-ce:rc3 |
| docker | docker | 17.06.1-ce:rc4 |
| docker | docker | 17.06.2-ce |
| docker | docker | 17.06.2-ce:rc1 |
| docker | docker | 17.07.0-ce |
| docker | docker | 17.07.0-ce:rc1 |
| docker | docker | 17.07.0-ce:rc2 |
| docker | docker | 17.07.0-ce:rc3 |
| docker | docker | 17.07.0-ce:rc4 |
| docker | docker | 17.09.0-ce |
| docker | docker | 17.09.0-ce:rc1 |
| docker | docker | 17.09.0-ce:rc2 |
| docker | docker | 17.09.0-ce:rc3 |
| docker | docker | 17.09.1-ce |
| docker | docker | 17.09.1-ce-:rc1 |
| docker | docker | 17.10.0-ce |
| docker | docker | 17.10.0-ce:rc1 |
| docker | docker | 17.10.0-ce:rc2 |
| docker | docker | 17.11.0-ce |
| docker | docker | 17.11.0-ce:rc1 |
| docker | docker | 17.11.0-ce:rc2 |
| docker | docker | 17.11.0-ce:rc3 |
| docker | docker | 17.11.0-ce:rc4 |
| docker | docker | 17.12.0-ce |
| docker | docker | 17.12.0-ce:rc1 |
| docker | docker | 17.12.0-ce:rc2 |
| docker | docker | 17.12.0-ce:rc3 |
| docker | docker | 17.12.0-ce:rc4 |
| docker | docker | 17.12.1-ce |
| docker | docker | 17.12.1-ce:rc1 |
| docker | docker | 17.12.1-ce:rc2 |
| docker | docker | 18.01.0-ce |
| docker | docker | 18.01.0-ce:rc1 |
| docker | docker | 18.02.0-ce |
| docker | docker | 18.02.0-ce:rc1 |
| docker | docker | 18.02.0-ce:rc2 |
| docker | docker | 18.03.0-ce |
| docker | docker | 18.03.0-ce:rc1 |
| docker | docker | 18.03.0-ce:rc2 |
| docker | docker | 18.03.0-ce:rc3 |
| docker | docker | 18.03.0-ce:rc4 |
| docker | docker | 18.03.1-ce |
| docker | docker | 18.03.1-ce:rc1 |
| docker | docker | 18.03.1-ce:rc2 |
| docker | docker | 18.04.0-ce |
| docker | docker | 18.04.0-ce:rc1 |
| docker | docker | 18.04.0-ce:rc2 |
| docker | docker | 18.05.0-ce |
| docker | docker | 18.05.0-ce:rc1 |
| docker | docker | 18.06.0-ce |
| docker | docker | 18.06.0-ce:rc1 |
| docker | docker | 18.06.0-ce:rc2 |
| docker | docker | 18.06.0-ce:rc3 |
| docker | docker | 18.06.1-ce:rc1 |
| docker | docker | 18.06.1-ce:rc2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References