CVEvulnerability

CVE-2018-15664

7.5 HIGH Published 2019-05-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-05-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.2 MEDIUM — AV:L/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
CWE-362

Description

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

Affected configurations

• docker docker 17.06.0-ce • docker docker 17.06.1-ce • docker docker 17.06.2-ce • docker docker 17.07.0-ce • docker docker 17.09.0-ce • docker docker 17.09.1-ce • docker docker 17.09.1-ce- • docker docker 17.10.0-ce • docker docker 17.11.0-ce • docker docker 17.12.0-ce • docker docker 17.12.1-ce • docker docker 18.01.0-ce • docker docker 18.02.0-ce • docker docker 18.03.0-ce • docker docker 18.03.1-ce • docker docker 18.04.0-ce • docker docker 18.05.0-ce • docker docker 18.06.0-ce • docker docker 18.06.1-ce

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References