CVE-2014-9356: docker Path Traversal
CVSS: 8.6v3.1HighModified
AliasesUBUNTU-CVE-2014-9356DEBIAN-CVE-2014-9356CGA-2r85-cfxm-qh9rCGA-3hrj-mgm6-h2x2CGA-452m-f3q4-cmfrCGA-4mqf-hv6c-2pw5CGA-96fr-5wqq-g54jCGA-cqcv-jgp5-45pjCGA-f52x-3c8c-4jprCGA-f78v-m23v-wjx3CGA-fp9q-j59f-6m86CGA-jjxv-586r-vfhcCGA-mphh-35q4-xcwhCGA-p5gx-463x-77m7CGA-qvc5-jhr5-rh3gCGA-v45g-cqfx-ffgqCGA-w75j-r67f-586mCGA-wm7v-5jrg-mrgmGHSA-vj3f-3286-r4pfGO-2022-0751
Published 02-12-2019Last modified 06-08-2024
Vulnerability summary
CVE-2014-9356 is a high (CVSS 8.6) Path Traversal vulnerability in docker. EPSS estimates a 4.92% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v3.1 (NVD)EPSS score
4.92%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 02-12-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 8.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NSources6 sources · 5.9–8.6
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
High 8.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:C/A:PSourcesSingle source
EPSS trend
Probability
4.92%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.92% on 20-09-2026
20-09-202620-10-2026
EPSS score4.92%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- dockerAll versions (No fix recorded)
- docker-config-mirror-gcrAll versions (No fix recorded)
- docker-dindAll versions (No fix recorded)
- docker-initAll versions (No fix recorded)
- docker-oci-entrypointAll versions (No fix recorded)
Wolfi8 products
- dockerAll versions (No fix recorded)
- docker-config-mirror-gcrAll versions (No fix recorded)
- docker-dindAll versions (No fix recorded)
- docker-initAll versions (No fix recorded)
- docker-oci-entrypointAll versions (No fix recorded)
Debian1 product
- docker.io< 1.3.3~dfsg1-1
Docker1 product
- docker< 1.3.3
Github.com/docker1 product
- docker< 1.3.3
Ubuntu1 product
- docker.io< 1.6.2~dfsg1-1ubuntu4~14.04.1
6 vendors · 20 products
References
12 links- www.securityfocus.com/archive/1/archive/1/534215/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkWEB
- groups.google.com/forum/REPORT
- github.com/moby/mobyPACKAGE