PT-2019-3466 · Docker+3 · Docker+3
Published
2019-07-29
·
Updated
2026-05-18
·
CVE-2019-14271
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Docker versions 19.03.x through 19.03.0
Description
The issue is related to code injection when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. This can occur in Docker linked against the GNU C Library (aka glibc). Exploitation of the vulnerability may allow a remote attacker to impact data integrity, gain unauthorized access to protected information, and cause a denial of service.
Recommendations
For Docker versions 19.03.x through 19.03.0, update to version 19.03.1 or later to resolve the issue. As a temporary workaround, consider restricting the dynamic loading of libraries inside a chroot to minimize the risk of exploitation. Avoid using the nsswitch facility in affected environments until the issue is resolved.
Fix
Improper Initialization
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Docker
Gnu C Library
Suse