PT-2018-10807 · Docker+1 · Docker+2

Published 2018-07-23 · Updated 2019-10-03 · CVE-2018-11756

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openwhisk/action-php-v7.2 versions 1.0.0 and earlier openwhisk/action-php-v7.1 versions 1.0.1 and earlier

Description The issue allows an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. This can occur in Docker actions that inherit from specific Docker tags.

Recommendations For openwhisk/action-php-v7.2 version 1.0.0 and earlier, consider updating to a newer version to prevent code exploitation. For openwhisk/action-php-v7.1 version 1.0.1 and earlier, consider updating to a newer version to prevent code exploitation. As a temporary workaround, consider restricting the use of user code that is vulnerable to code exploitation until a patch is available.

Fix

Related Identifiers

CVE-2018-11756

Affected Products

Docker

Openwhisk/Action-Php-V7.1

Openwhisk/Action-Php-V7.2

References · 7

• https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11756 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11756 · Vendor Advisory
• http://securityfocus.com/bid/104915 · Note
• https://puresec.io/hubfs/Apache%20OpenWhisk%20PureSec%20Security%20Advisory.pdf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11756 · Note
• https://lists.apache.org/thread.html/439bd5ff5822708c645a0d816ed9914b88c97eda32eae6ea211bc0dc%40%3Cdev.openwhisk.apache.org%3E · Note