Red Hat Security Advisory: docker security, bug fix, and enhancement update

Fixed packages 4

Vulnerabilities 2

• Critical 9.8
  CVE-2014-9357

  Arbitrary Code Execution

  Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

  docker.io github.com/docker/docker Debian Go
  Dec 16, 2014
• Medium 5.9
  CVE-2014-9356

  Path Traversal in Docker

  Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

  docker.io github.com/docker/docker Debian Go
  Dec 2, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#low
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1092773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1100009
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1102568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1113608
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1162807
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1172761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1172782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1174351
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0623.json
• report
  https://access.redhat.com/security/cve/CVE-2014-9356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-9356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-9356
• article
  https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw
• report
  https://access.redhat.com/security/cve/CVE-2014-9357
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-9357
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-9357