CVE-2014-9357: Arbitrary Code Execution in Docker
Summary
CVE-2014-9357: Arbitrary Code Execution. Affects github.com/docker/docker versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9357 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that allows developers to automate the deployment and management of applications within containers. It provides a lightweight and portable environment for running software, enabling efficient resource utilization and easy scalability. Docker is written in Go and is widely used in the software development industry.
However, Docker version 1.3.2 is vulnerable to an arbitrary code execution attack. This vulnerability allows remote attackers to execute arbitrary code with root privileges by exploiting a flaw in the handling of LZMA (.xz) archives. Specifically, the vulnerability lies in the chroot mechanism used for archive extraction.
The vulnerability has a high severity rating with a CVSS score of 9.8, indicating its potential for significant impact on affected systems.
Vulnerability Detail
The vulnerability in Docker 1.3.2 arises from a lack of proper input validation and sanitization when processing LZMA archives. By crafting a malicious image or including a malicious build command in a Dockerfile within an LZMA archive, an attacker can trigger the execution of arbitrary code with root privileges. This can lead to a complete compromise of the affected system, allowing the attacker to gain unauthorized access, modify data, or launch further attacks.
The vulnerability is considered severe due to the high level of privilege escalation it enables and the potential for widespread damage if exploited in a production environment. It is crucial for users of Docker 1.3.2 to take immediate action to mitigate this risk.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade Docker to the patched version to mitigate the risk of arbitrary code execution.
Conclusion
The vulnerability in Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges, posing a severe security risk. To mitigate this vulnerability, it is crucial to upgrade Docker to version 1.3.3 or later. Regularly checking for updates and following best practices for secure containerization can help prevent similar vulnerabilities in the future.
For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that enables developers to automate the deployment and management of applications within containers. It provides a lightweight and portable environment for running software, facilitating efficient resource utilization and scalability.
The vulnerability allows remote attackers to execute arbitrary code with root privileges on systems running Docker 1.3.2. This can lead to unauthorized access, data manipulation, and potential further compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade Docker to version 1.3.3 or later. The updated version includes a patch that addresses the issue and prevents the execution of arbitrary code with root privileges.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the only solution to mitigate the risk.
This vulnerability has a high severity rating with a CVSS score of 9.8, indicating its potential for significant impact on affected systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
