Description
Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the embedded layer data in an image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | golang-github-appc-docker2aci | 0.14.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-github-appc-docker2aci | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-appc-docker2aci | No fix yet | — |
References
- https://github.com/appc/docker2aci/issues/201
- https://github.com/appc/docker2aci/releases/tag/v0.13.0
- [oss-security] 20160928 CVE Request: docker2aci: Path traversals present in image converting mailing-list
- [oss-security] 20160928 Re: CVE Request: docker2aci: Path traversals present in image converting mailing-list
- 93194 vdb-entry