PT-2019-3476 · Docker · Docker
Etienne Stalmans
+1
·
Published
2019-03-27
·
Updated
2020-12-22
·
CVE-2019-13139
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Docker versions prior to 18.09.4
Description
The issue is related to insufficient argument validation in the
docker build command, allowing an attacker to potentially gain unauthorized access to information, cause a denial of service, or impact the availability of information. Specifically, the problem lies in how docker build processes remote git URLs, leading to command injection into the underlying git clone command. This can result in code execution in the context of the user executing the docker build command, as git ref can be misinterpreted as a flag.Recommendations
For Docker versions prior to 18.09.4, update to version 18.09.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
docker build command with remote git URLs to minimize the risk of exploitation. Avoid using potentially malicious git URLs in the docker build command until the issue is resolved.Exploit
Fix
OS Command Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Docker