PT-2020-7588 · Docker · Docker

Published 2020-01-02 · Updated 2023-03-01 · CVE-2014-0048

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker versions prior to 1.6.0

Description An issue was found where some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. This poses a risk due to the lack of encryption and authentication in HTTP, making it possible for attackers to intercept and modify the data being downloaded.

Recommendations For Docker versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the execution of scripts and programs downloaded via HTTP until a patch is available. Avoid using HTTP for downloading and executing programs and scripts in Docker until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-0048

Affected Products

Docker

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0048 · Security Note
• https://osv.dev/vulnerability/CVE-2014-0048 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-0048 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0048 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0048 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0048 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1063550 · Note
• https://t.me/cibsecurity/8951 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0048 · Note
• https://access.redhat.com/security/cve/cve-2014-0048 · Note
• https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E · Note
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0048 · Note
• http://openwall.com/lists/oss-security/2015/03/24/23 · Note
• http://openwall.com/lists/oss-security/2015/03/24/18 · Note