CVE-2018-20699: docker engine Uncontrolled Resource Consumption
CVSS: 4.9v3.0MediumModified
AliasesMGASA-2019-0076RHSA-2019:0487UBUNTU-CVE-2018-20699DEBIAN-CVE-2018-20699CGA-3627-97x5-xgq4CGA-g3hj-3hc6-6x5cCGA-2f3h-9x5c-g4w9CGA-2hr5-v7jc-3272CGA-2w5g-gmgj-27v6CGA-5864-pr95-2996CGA-59cv-8xqm-cc73CGA-5jmh-9g3h-p6fjCGA-5qqv-84mp-xxhpCGA-5rxv-vc8r-23phCGA-652x-pfq8-m374CGA-6gh4-m6vc-rf4mCGA-749w-6xjr-82jrCGA-76q7-243j-4fp4CGA-7vw6-gxj9-r632CGA-89x7-342j-xmh4CGA-c9fp-m685-g55vCGA-cvhx-p8rf-9grpCGA-f52x-ppm8-gg2pCGA-fm97-64mq-qv53CGA-hhf4-m442-hwrrCGA-hq9m-cvfm-w64gCGA-hxpq-v9j6-c5jpCGA-jcj8-9rch-mvfcCGA-m33r-28gv-f54fCGA-p8q4-fw53-28vqCGA-phvj-c3j8-7rhwCGA-q2jp-cgq8-m2q3CGA-qxf3-g4q3-9vxwCGA-r42w-mphr-7hgvCGA-wppw-v8fr-75chCGA-x2q9-wm2x-2fqc
Published 12-01-2019Last modified 05-08-2024
Vulnerability summary
CVE-2018-20699 is a medium (CVSS 4.9) Uncontrolled Resource Consumption vulnerability in docker engine. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v3.0 (NVD)EPSS score
2.23%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 8Timeline
- 12-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 4.9Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSources6 sources · 4.5–4.9
- OSV · Red hatEcosystem advisory · calculated4.5MediumCVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated4.9MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.23%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.23% on 19-09-2026
19-09-202619-10-2026
EPSS score2.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- auditbeat-7< 7.17.28-r3
- auditbeat-7-oci-entrypoint< 7.17.28-r3
- auditbeat-fips-7< 7.17.28-r5
- beats-7< 7.17.28-r3
- beats-fips-7< 7.17.28-r5
Redhat10 products
- enterprise_linux_server7.0
- docker< 2:1.13.1-94.gitb2f74b2.el7
- docker-client< 2:1.13.1-94.gitb2f74b2.el7
- docker-common< 2:1.13.1-94.gitb2f74b2.el7
- docker-debuginfo< 2:1.13.1-94.gitb2f74b2.el7
Debian1 product
- docker.io< 18.09.1+dfsg1-2
Docker1 product
- engine< 18.09
Mageia1 product
- docker< 18.06.1-1.2.mga6
Ubuntu1 product
- docker.io< 18.09.2-0ubuntu1~16.04.1 | < 18.09.2-0ubuntu1~18.04.1
Wolfi1 product
- gitnessAll versions (No fix recorded)
7 vendors · 31 products
References
20 links- access.redhat.com/errata/RHSA-2019:0487Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
