Vulnerability-Lookup

RHBA-2014:1977

Vulnerability from csaf_redhat - Published: 2014-12-10 11:38 - Updated: 2026-11-05 04:02

Summary

Red Hat Bug Fix Advisory: docker bug fix and enhancement update

Severity

Low

Notes

Topic: An updated docker package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 7 Extras.

Details: Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. The docker packages have been upgraded to upstream version 1.3.2, which provides a number of bug fixes and enhancements over the previous version, the most notable of which is the "exec" command which allows for processes to be spawned inside a Docker container. (BZ#1167870) Users of docker are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements. After installing the update, docker containers must be restarted for the changes to take effect.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2014-6407

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

3.7 ()


                
                  AV:L/AC:H/Au:M/C:N/I:C/A:N

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 7Server-EXTRAS:docker-0:1.3.2-4.el7.src		—	Vendor Fix fix
Unresolved product id: 7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64		—	Vendor Fix fix

Threats

Impact Low

CVE-2014-9358

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

7.1 ()


                
                  AV:N/AC:M/Au:N/C:N/I:C/A:N

Affected products

Fixed 2 products, the same list as for CVE-2014-6407

Threats

Impact Low

References

12 references

URL	Category
https://access.redhat.com/errata/RHBA-2014:1977	self
https://bugzilla.redhat.com/show_bug.cgi?id=1167870	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2014-6407	self
https://bugzilla.redhat.com/show_bug.cgi?id=1167505	external
https://www.cve.org/CVERecord?id=CVE-2014-6407	external
https://nvd.nist.gov/vuln/detail/CVE-2014-6407	external
https://access.redhat.com/security/cve/CVE-2014-9358	self
https://bugzilla.redhat.com/show_bug.cgi?id=1172787	external
https://www.cve.org/CVERecord?id=CVE-2014-9358	external
https://nvd.nist.gov/vuln/detail/CVE-2014-9358	external
https://groups.google.com/forum/#!topic/docker-us…	external

Acknowledgments

Docker project

Docker Inc.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated docker package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 7 Extras.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Docker is an open-source engine that automates the deployment of any application\nas a lightweight, portable, self-sufficient container that will run virtually\nanywhere.\n\nThe docker packages have been upgraded to upstream version 1.3.2, which provides\na number of bug fixes and enhancements over the previous version, the most\nnotable of which is the \"exec\" command which allows for processes to be spawned\ninside a Docker container. (BZ#1167870)\n\nUsers of docker are advised to upgrade to this updated package, which fixes\nthese bugs and adds these enhancements. After installing the update, docker\ncontainers must be restarted for the changes to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2014:1977",
        "url": "https://access.redhat.com/errata/RHBA-2014:1977"
      },
      {
        "category": "external",
        "summary": "1167870",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1167870"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhba-2014_1977.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: docker bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-05T04:02:26+00:00",
      "generator": {
        "date": "2026-11-05T04:02:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHBA-2014:1977",
      "initial_release_date": "2014-12-10T11:38:14+00:00",
      "revision_history": [
        {
          "date": "2014-12-10T11:38:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-15T16:33:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-05T04:02:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux 7 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux 7 Extras",
                  "product_id": "7Server-EXTRAS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras_other:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Extras"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-0:1.3.2-4.el7.src",
                "product": {
                  "name": "docker-0:1.3.2-4.el7.src",
                  "product_id": "docker-0:1.3.2-4.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/docker@1.3.2-4.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "docker-0:1.3.2-4.el7.x86_64",
                "product": {
                  "name": "docker-0:1.3.2-4.el7.x86_64",
                  "product_id": "docker-0:1.3.2-4.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/docker@1.3.2-4.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-0:1.3.2-4.el7.src as a component of Red Hat Enterprise Linux 7 Extras",
          "product_id": "7Server-EXTRAS:docker-0:1.3.2-4.el7.src"
        },
        "product_reference": "docker-0:1.3.2-4.el7.src",
        "relates_to_product_reference": "7Server-EXTRAS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "docker-0:1.3.2-4.el7.x86_64 as a component of Red Hat Enterprise Linux 7 Extras",
          "product_id": "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
        },
        "product_reference": "docker-0:1.3.2-4.el7.x86_64",
        "relates_to_product_reference": "7Server-EXTRAS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Docker project"
          ]
        }
      ],
      "cve": "CVE-2014-6407",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2014-11-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1167505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "docker: symbolic and hardlink issues leading to privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. However, this flaw is not known to be exploitable under any supported scenario. A future update may address this issue.\n\nRed Hat does not support or recommend running untrusted images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
          "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-6407"
        },
        {
          "category": "external",
          "summary": "RHBZ#1167505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1167505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-6407",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-6407"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-6407",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6407"
        }
      ],
      "release_date": "2014-11-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-10T11:38:14+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2014:1977"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "MULTIPLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "confidentialityImpact": "NONE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:H/Au:M/C:N/I:C/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "docker: symbolic and hardlink issues leading to privilege escalation"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Docker Inc."
          ]
        }
      ],
      "cve": "CVE-2014-9358",
      "discovery_date": "2014-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1172787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "docker: Path traversal and spoofing opportunities presented through image identifiers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
          "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-9358"
        },
        {
          "category": "external",
          "summary": "RHBZ#1172787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1172787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-9358",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-9358"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-9358",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9358"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw",
          "url": "https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw"
        }
      ],
      "release_date": "2014-12-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-10T11:38:14+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2014:1977"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:C/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.src",
            "7Server-EXTRAS:docker-0:1.3.2-4.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "docker: Path traversal and spoofing opportunities presented through image identifiers"
    }
  ]
}

CVE-2014-6407 (GCVE-0-2014-6407)

Vulnerability from cvelistv5 – Published: 2014-12-12 15:00 – Updated: 2024-08-06 12:17

Summary

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2262 records in the last 180 days details

References

6 references

URL	Tags
http://secunia.com/advisories/60241	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/60171	third-party-advisoryx_refsource_SECUNIA
https://docs.docker.com/v1.3/release-notes/	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.openwall.com/lists/oss-security/2014/11/24/5	mailing-listx_refsource_MLIST

Date Public

2014-11-24 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T12:17:23.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "60241",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60241"
          },
          {
            "name": "60171",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60171"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://docs.docker.com/v1.3/release-notes/"
          },
          {
            "name": "openSUSE-SU-2014:1596",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
          },
          {
            "name": "FEDORA-2014-15779",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
          },
          {
            "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-12-12T13:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "60241",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60241"
        },
        {
          "name": "60171",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60171"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://docs.docker.com/v1.3/release-notes/"
        },
        {
          "name": "openSUSE-SU-2014:1596",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
        },
        {
          "name": "FEDORA-2014-15779",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
        },
        {
          "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-6407",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "60241",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60241"
            },
            {
              "name": "60171",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60171"
            },
            {
              "name": "https://docs.docker.com/v1.3/release-notes/",
              "refsource": "CONFIRM",
              "url": "https://docs.docker.com/v1.3/release-notes/"
            },
            {
              "name": "openSUSE-SU-2014:1596",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html"
            },
            {
              "name": "FEDORA-2014-15779",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html"
            },
            {
              "name": "[oss-security] 20141124 Docker 1.3.2 - Security Advisory [24 Nov 2014]",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2014/11/24/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-6407",
    "datePublished": "2014-12-12T15:00:00.000Z",
    "dateReserved": "2014-09-15T00:00:00.000Z",
    "dateUpdated": "2024-08-06T12:17:23.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9358 (GCVE-0-2014-9358)

Vulnerability from cvelistv5 – Published: 2014-12-16 18:00 – Updated: 2024-08-06 13:40

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2262 records in the last 180 days details

References

2 references

URL	Tags
https://groups.google.com/forum/#%21msg/docker-us…	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/534215/100…	mailing-listx_refsource_BUGTRAQ

Date Public

2014-12-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:25.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
          },
          {
            "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-12-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
        },
        {
          "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9358",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) \"docker load\" operation or (2) \"registry communications.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!msg/docker-user/nFAz-B-n4Bw/0wr3wvLsnUwJ"
            },
            {
              "name": "20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/534215/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9358",
    "datePublished": "2014-12-16T18:00:00.000Z",
    "dateReserved": "2014-12-09T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:40:25.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHBA-2014:1977

CVE-2014-6407 (GCVE-0-2014-6407)

CVE-2014-9358 (GCVE-0-2014-9358)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour