PT-2018-10808 · Apache · Docker Skeleton Runtime For Apache Openwhisk

Ory Segal + 1 · Publicado 2018-07-23 · Atualizado 2019-10-03 · CVE-2018-11757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier

Description The issue allows an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. This can occur in a Docker action that inherits the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier.

Recommendations For Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier, consider updating to a newer version that contains a fix for this issue, although the specific fixed version is not provided in the available data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2018-11757

Produtos afetados

Docker Skeleton Runtime For Apache Openwhisk

Referências · 6

• https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8 · Correção
• https://puresec.io/hubfs/Apache%20OpenWhisk%20PureSec%20Security%20Advisory.pdf · Nota
• https://osv.dev/vulnerability/CVE-2018-11757 · Aviso do Fabricante
• https://lists.apache.org/thread.html/0b6d8a677f1c063ed32eb3638ef4d1a47dfba8907de4b222ddd24b05%40%3Cdev.openwhisk.apache.org%3E · Nota
• http://securityfocus.com/bid/104913 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11757 · Nota de Segurança