CVE-2016-8579: Denial of Service in docker2aci
Summary
CVE-2016-8579: Denial of Service in docker2aci. Affects github.com/appc/docker2aci versions < 0.13.0. Fixed in 0.13.0. How to fix ↓
Also tracked for
- golang-github-appc-docker2aci · Debian:11
The same CVE-2016-8579 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is docker2aci, a Go package that converts Docker images to App Container Images (ACIs). It provides functionality to convert Docker images to ACIs, which are lightweight and portable container images. This vulnerability affects versions <= 0.12.3 of docker2aci. The package is vulnerable to an infinite loop when handling local images with a cyclic dependency chain.
Vulnerability Detail
The vulnerability (CVE-2016-8579) in docker2aci allows an attacker to trigger an infinite loop by providing local images with a cyclic dependency chain. This can lead to a denial of service (DoS) condition, where the affected system becomes unresponsive or crashes. The infinite loop occurs during the handling of these images, causing excessive resource consumption and impacting the availability of the system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.0.
How To Fix
Minimum fixed version
0.13.0
This is the first release that contains the fix.
go get github.com/appc/docker2aci@v0.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of docker2aci.
Conclusion
In conclusion, the vulnerability (CVE-2016-8579) in docker2aci allows an attacker to trigger an infinite loop, leading to a denial of service (DoS) condition. To mitigate this vulnerability, it is recommended to upgrade to version 0.13.0 or later of docker2aci. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/appc/docker2aci →
FAQ
docker2aci is a Go package that converts Docker images to App Container Images (ACIs). It provides functionality to convert Docker images to ACIs, which are lightweight and portable container images.
The vulnerability allows an attacker to trigger an infinite loop, leading to a denial of service (DoS) condition. This can result in the affected system becoming unresponsive or crashing.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.0.
To fix this vulnerability, it is recommended to upgrade to version 0.13.0 or later of docker2aci.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of docker2aci.
