PT-2018-10808 · Apache · Docker Skeleton Runtime For Apache Openwhisk

Ory Segal + 1 · Published 2018-07-23 · Updated 2019-10-03 · CVE-2018-11757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier

Description The issue allows an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. This can occur in a Docker action that inherits the Docker tag openwhisk/dockerskeleton:1.3.0 or earlier.

Recommendations For Docker Skeleton Runtime for Apache OpenWhisk versions 1.3.0 and earlier, consider updating to a newer version that contains a fix for this issue, although the specific fixed version is not provided in the available data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-11757

Affected Products

Docker Skeleton Runtime For Apache Openwhisk

References · 6

• https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8 · Patch
• https://osv.dev/vulnerability/CVE-2018-11757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11757 · Security Note
• https://puresec.io/hubfs/Apache%20OpenWhisk%20PureSec%20Security%20Advisory.pdf · Note
• https://lists.apache.org/thread.html/0b6d8a677f1c063ed32eb3638ef4d1a47dfba8907de4b222ddd24b05%40%3Cdev.openwhisk.apache.org%3E · Note
• http://securityfocus.com/bid/104913 · Note