Description
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-machine-driver-harvester | 1.0.4-r1 | — |
| Wolfi rolling | rancher-machine | 0.15.0.137-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/docker/docker | < 19.03.9 | 19.03.9 | GHSA-6hwg-w5jg-9c6x |
| Go | github.com/moby/moby | < 19.03.9 | 19.03.9 | GHSA-6hwg-w5jg-9c6x |