CVE-2014-6407

Aliases:GHSA-5qgp-p5jc-w2rmGO-2022-0630DEBIAN-CVE-2014-6407CGA-2wpf-x5fh-6gm3CGA-4rq6-q269-gc5pCGA-5h44-p796-7j8hCGA-6cwq-423f-xfpqCGA-6m2j-f3v3-6gpvCGA-93mp-77hr-3vjqCGA-c5xr-9rwp-47wrCGA-f476-3v58-9grhCGA-h5ph-6mjw-7rv3CGA-m8h8-qmcj-m592CGA-mh6h-2vx4-5phgCGA-p5vw-6g7c-q6qpCGA-qw28-mw56-qhj7CGA-wj96-863x-rhc9CGA-wr22-wgx2-vrg6CGA-xh9x-g227-x4jv
Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 12 Dec 2014, 15:00
Last modified:06 Aug 2024, 12:17

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
4.91% LOW
5% probability -0.67%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Dec 2014, 15:00
Published
Vulnerability first disclosed
06 Aug 2024, 12:17
Last Modified
Vulnerability information updated

Description

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

CVSS Metrics

  • v3.1•HIGH•Score: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 4.91%• Percentile: 92%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • chainguard•docker

    < 0

  • chainguard•docker-config-mirror-gcr

    < 0

  • chainguard•docker-dind

    < 0

  • chainguard•docker-init

    < 0

  • chainguard•docker-oci-entrypoint

    < 0

  • chainguard•dockerd

    < 0

  • chainguard•dockerd-oci-entrypoint

    < 0

  • chainguard•dockerd-service

    < 0

  • wolfi•docker

    < 0

  • wolfi•docker-config-mirror-gcr

    < 0

  • wolfi•docker-dind

    < 0

  • wolfi•docker-init

    < 0

  • wolfi•docker-oci-entrypoint

    < 0

  • wolfi•dockerd

    < 0

  • wolfi•dockerd-oci-entrypoint

    < 0

  • wolfi•dockerd-service

    < 0

  • debian•docker.io

    < 1.3.2~dfsg1-1 | < 1.3.2~dfsg1-1 | < 1.3.2~dfsg1-1 | < 1.3.2~dfsg1-1

  • docker•docker

    ≤ 1.3.1 | 1.0.0 | 1.3.0

  • github.com/docker•docker

    < 1.3.2

References (17)