CVE-2018-15664: docker

Modified

AliasesSUSE-SU-2019:1514-1SUSE-SU-2019:1562-1RHSA-2019:1910+4 more

Published 23-05-2019Last modified 05-08-2024

Vulnerability summary

CVE-2018-15664 is a high (CVSS 7.5) vulnerability in docker. EPSS estimates a 3.43% chance of exploitation in the next 30 days, higher than 88.9% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.0 (NVD)

EPSS score

3.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 8

OPENSUSE-SU-2019:2044-1 OPENSUSE-SU-2024:10722-1 OPENSUSE-SU-2024:10931-1 OPENSUSE-SU-2025:15589-1 SUSE-SU-2019:2223-1 SUSE-SU-2025:03540-1+2 more

Timeline

23-05-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

CVSS metrics

6 scores · 5 sources · 2 versions

v3.07.5v2.06.2

EPSS trend

Probability

3.43%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugzilla.suse.com)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat9 products

docker< 2:1.13.1-102.git7f2769b.el7
docker-client< 2:1.13.1-102.git7f2769b.el7
docker-common< 2:1.13.1-102.git7f2769b.el7
docker-debuginfo< 2:1.13.1-102.git7f2769b.el7
docker-logrotate< 2:1.13.1-102.git7f2769b.el7

Show all 9

Suse3 products

docker&distro=SUSE Linux Enterprise Module for Containers 12< 18.09.6_ce-98.40.1
docker&distro=SUSE Linux Enterprise Module for Containers 15< 18.09.6_ce-6.20.3
docker&distro=SUSE Linux Enterprise Module for Containers 15 SP1< 18.09.6_ce-6.20.3

Opensuse2 products

docker&distro=openSUSE Leap 15.0< 18.09.6_ce-lp151.2.6.1
docker&distro=openSUSE Leap 15.1< 18.09.6_ce-lp151.2.6.1

Alpine1 product

docker< 18.09.7-r0 | < 18.09.7

Debian1 product

docker.io< 18.09.1+dfsg1-7.1

Docker1 product

docker17.06.0-ce | 17.06.0-ce:rc1 | 17.06.0-ce:rc2 | 17.06.0-ce:rc3 | 17.06.0-ce:rc4 | 17.06.0-ce:rc5 | 17.06.1-ce | 17.06.1-ce:rc1 | 17.06.1-ce:rc2 | 17.06.1-ce:rc3 | 17.06.1-ce:rc4 | 17.06.2-ce | 17.06.2-ce:rc1 | 17.07.0-ce | 17.07.0-ce:rc1 | 17.07.0-ce:rc2 | 17.07.0-ce:rc3 | 17.07.0-ce:rc4 | 17.09.0-ce | 17.09.0-ce:rc1 | 17.09.0-ce:rc2 | 17.09.0-ce:rc3 | 17.09.1-ce | 17.09.1-ce-:rc1 | 17.10.0-ce | 17.10.0-ce:rc1 | 17.10.0-ce:rc2 | 17.11.0-ce | 17.11.0-ce:rc1 | 17.11.0-ce:rc2 | 17.11.0-ce:rc3 | 17.11.0-ce:rc4 | 17.12.0-ce | 17.12.0-ce:rc1 | 17.12.0-ce:rc2 | 17.12.0-ce:rc3 | 17.12.0-ce:rc4 | 17.12.1-ce | 17.12.1-ce:rc1 | 17.12.1-ce:rc2 | 18.01.0-ce | 18.01.0-ce:rc1 | 18.02.0-ce | 18.02.0-ce:rc1 | 18.02.0-ce:rc2 | 18.03.0-ce | 18.03.0-ce:rc1 | 18.03.0-ce:rc2 | 18.03.0-ce:rc3 | 18.03.0-ce:rc4 | 18.03.1-ce | 18.03.1-ce:rc1 | 18.03.1-ce:rc2 | 18.04.0-ce | 18.04.0-ce:rc1 | 18.04.0-ce:rc2 | 18.05.0-ce | 18.05.0-ce:rc1 | 18.06.0-ce | 18.06.0-ce:rc1 | 18.06.0-ce:rc2 | 18.06.0-ce:rc3 | 18.06.1-ce:rc1 | 18.06.1-ce:rc2

Ubuntu1 product

docker.io< 18.09.7-0ubuntu1~16.04.4 | < 18.09.7-0ubuntu1~18.04.3

7 vendors · 18 products

References

28 links

bugzilla.suse.com/show_bug.cgi?id=1096726X Refsource MISCExploitIssue TrackingThird Party Advisory
github.com/moby/moby/pull/39252X Refsource MISCIssue TrackingThird Party Advisory
www.openwall.com/lists/oss-security/2019/05/28/1Mailing ListX Refsource MLISTExploitThird Party Advisory
www.securityfocus.com/bid/108507VDB EntryX Refsource BIDThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.htmlVendor AdvisoryX Refsource SUSE
usn.ubuntu.com/4048-1/Vendor AdvisoryX Refsource UBUNTU
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-15664X Refsource CONFIRM
access.redhat.com/errata/RHSA-2019:1910Vendor AdvisoryX Refsource REDHATAdvisory
www.openwall.com/lists/oss-security/2019/08/21/1Mailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.htmlVendor AdvisoryX Refsource SUSE

Show all 28 references

access.redhat.com/security/cve/cve-2018-15664Third Party Advisory
www.suse.com/support/update/announcement/2019/suse-su-20191514-1/Advisory
bugzilla.suse.com/1096726REPORT
www.suse.com/security/cve/CVE-2018-15664WEB
www.suse.com/support/update/announcement/2019/suse-su-20191562-1/Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1714722REPORT
bugzilla.redhat.com/show_bug.cgi?id=1723491REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1910.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-15664REPORT
www.cve.org/CVERecord?id=CVE-2018-15664AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-15664Advisory
www.openwall.com/lists/oss-security/2019/05/28/1ARTICLEREPORT
ubuntu.com/security/CVE-2018-15664REPORT
ubuntu.com/security/notices/USN-4048-1Advisory
security-tracker.debian.org/tracker/CVE-2018-15664Advisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2018-15664Advisory