Path Traversal Vulnerability in Docker.io - CVE-2014-9358
Summary
CVE-2014-9358: Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry commu... Affects docker.io versions < 1.3.3~dfsg1-1. Fixed in 1.3.3~dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment of applications inside software containers. It allows developers to package applications with all their dependencies into a standardized unit for software development. The Docker.io package is the Debian version of Docker, which is widely used in various environments. This specific vulnerability affects Docker versions prior to 1.3.3, where improper validation of image IDs can lead to security risks.
Vulnerability Detail
CVE-2014-9358 is a vulnerability in Docker before version 1.3.3 that fails to properly validate image IDs. This flaw allows remote attackers to perform path traversal attacks, potentially spoofing repositories through crafted images during 'docker load' operations or registry communications. The implications of this vulnerability can lead to unauthorized access to sensitive data or manipulation of Docker images, posing significant risks to systems relying on Docker for containerization.
How To Fix
Minimum fixed version
1.3.3~dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to Docker daemon and implementing network security measures to limit exposure to untrusted sources. Additionally, avoid using unverified images from public repositories until the vulnerability is addressed.
Conclusion
CVE-2014-9358 is a significant vulnerability affecting Docker versions prior to 1.3.3, allowing for path traversal attacks due to improper image ID validation. It is crucial for users to upgrade their Docker installations to mitigate this risk and ensure the security of their containerized applications.
See every vulnerability recorded for docker.io →
FAQ
CVE-2014-9358 is a vulnerability in Docker that allows attackers to exploit improper image ID validation, leading to potential path traversal attacks.
You can check your Docker version by running 'docker --version' in your terminal. If it is below 1.3.3, it is affected.
The risks include unauthorized access to sensitive data, manipulation of Docker images, and potential compromise of the host system.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check for vulnerabilities without installation at Vulert Scanner.
Implement security measures such as restricting access to the Docker daemon and avoiding untrusted images until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
