PT-2020-16700 · Docker · Docker Engine+1

Published 2020-12-30 · Updated 2024-01-31 · CVE-2020-27534

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 19.03.9

Description The issue arises from the util/binfmt misc/check.go file in the Builder component of Docker Engine, where it calls os.OpenFile with a potentially unsafe temporary pathname for qemu-check. This pathname is constructed using an empty first argument in an ioutil.TempDir call.

Recommendations For Docker Engine versions prior to 19.03.9, update to version 19.03.9 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-27534

GHSA-6HWG-W5JG-9C6X

Affected Products

Docker

Docker Engine

References · 10

• https://osv.dev/vulnerability/CVE-2020-27534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27534 · Security Note
• https://osv.dev/vulnerability/GHSA-6hwg-w5jg-9c6x · Vendor Advisory
• https://github.com/moby/moby/pull/40877 · Note
• https://github.com/moby/buildkit/pull/1462 · Note
• https://t.me/cvenotify/7999 · Telegram Post
• https://golang.org/pkg/os/#TempDir · Note
• https://golang.org/pkg/io/ioutil/#TempDir · Note
• http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1921154 · Note