CVE-2014-5282
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
- Обновитесь до 1.3.0~dfsg1-1
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости docker.io · Страница 3
За последние 30 дней в docker.io опубликовано уязвимостей: 2; в каталоге KEV: 0.
Уязвимостей: 54
CVE-2017-16539
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
- Обновитесь до 1.13.1~ds3-1
Опубликовано ОбновленоCVE-2017-14992
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.
- Обновитесь до 18.03.1+dfsg1-2
Опубликовано ОбновленоCVE-2014-0047
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
- Обновитесь до 1.6.0+dfsg1-1
Опубликовано ОбновленоCVE-2016-9962
RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
- Обновитесь до 1.13.1~ds1-2
Опубликовано ОбновленоCVE-2015-3631
Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
- Обновитесь до 1.6.1+dfsg1-1
Опубликовано ОбновленоCVE-2015-3630
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
- Обновитесь до 1.6.1+dfsg1-1
Опубликовано ОбновленоCVE-2015-3629
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
- Обновитесь до 1.6.1+dfsg1-1
Опубликовано ОбновленоCVE-2015-3627
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
- Обновитесь до 1.6.1+dfsg1-1
Опубликовано ОбновленоCVE-2014-9358
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
- Обновитесь до 1.3.3~dfsg1-1
Опубликовано ОбновленоCVE-2014-9357
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
- Обновитесь до 1.3.3~dfsg1-1
Опубликовано ОбновленоCVE-2014-6408
Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
- Обновитесь до 1.3.2~dfsg1-1
Опубликовано ОбновленоCVE-2014-6407
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
- Обновитесь до 1.3.2~dfsg1-1
Опубликовано ОбновленоCVE-2014-5277
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
- Обновитесь до 1.3.1~dfsg1-1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.