Skip to content
OpenAdvisories
High ELSA-2014-3110 3 CVEs

Important: docker security update (Oracle Linux 7)

Published Dec 30, 2014 · Updated Dec 30, 2014

Ecosystem: Oracle Linux

Summary

[1.3.3-1.0.1]
- Rename requirement of docker-io-pkg-devel in %package devel as docker-pkg-devel
- Restore SysV init scripts for Oracle Linux 6
- Require Oracle Unbreakable Enterprise Kernel Release 3 or higher
- Rename as docker.
- Re-enable btrfs graphdriver support

[1.3.3-1]
- Update source to 1.3.3 from https://github.com/docker/docker/releases/tag/v1.3.3
Path traversal during processing of absolute symlinks (CVE-2014-9356)
Escalation of privileges during decompression of LZMA (.xz) archives (CVE-2014-9357)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 docker 0:1.3.3-1.0.1.el7
Oracle Linux · 7 docker-devel 0:1.3.3-1.0.1.el7
Oracle Linux · 7 docker-pkg-devel 0:1.3.3-1.0.1.el7

Vulnerabilities 3

  • Critical 9.8
    CVE-2014-9357

    Arbitrary Code Execution

    Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

    docker.io github.com/docker/docker Debian Go
  • Medium 6.5
    CVE-2014-9358

    Directory Traversal in Docker

    Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

    docker.io github.com/docker/docker Debian Go
  • Medium 5.9
    CVE-2014-9356

    Path Traversal in Docker

    Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

    docker.io github.com/docker/docker Debian Go