GitHub Advisoryadvisory · Go

GHSA-6hwg-w5jg-9c6x Path Traversal in Moby builder

MEDIUM Published 2024-01-31 Modified 2024-04-22 Official page ↗
Aliases
CVE-2020-27534
Ecosystem
Go
Packages
github.com/moby/moby, github.com/docker/docker
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-01-31

Affected packages

• Go github.com/moby/moby: < 19.03.9 → fixed in 19.03.9 • Go github.com/docker/docker: < 19.03.9 → fixed in 19.03.9

Description

util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.

Related

Alias · CVE (1)

  • CVE-2020-27534 util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References