CVE-2019-13139
Summary
| CVE | CVE-2019-13139 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-08-22 20:15:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| gitutils: add validation for ref by andrewhsu · Pull Request #38944 · moby/moby · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Bugtraq: [SECURITY] [DSA 4521-1] docker.io security update | BUGTRAQ | seclists.org | |
| Debian -- Security Information -- DSA-4521-1 docker.io | DEBIAN | www.debian.org | |
| Docker Engine release notes | Docker Documentation | MISC | docs.docker.com | Release Notes, Vendor Advisory |
| Red Hat Customer Portal - Access to 24x7 support and knowledge | REDHAT | access.redhat.com | |
| CVE-2019-13139 - Docker build code execution · Staaldraad | MISC | staaldraad.github.io | Exploit, Third Party Advisory |
| CVE-2019-13139 Docker Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.