Critical Code Injection Vulnerability in Docker.io - CVE-2019-14271
Summary
CVE-2019-14271: In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. Affects docker.io across 3 version ranges.
< 18.09.1+dfsg1-9
>= 705d9623b7c1fac1f8cf48074d5861847d09eb67, < fa8dd90ceb7bcb9d554d27e0b9087ab83e54bd2b
>= aeac9490dc54c1d48b3d7ae9a46f5a19b78dcd3a, < 74b1e89e8ac68948be88fe0aa1e2767ae28659fe
Fixed in 18.09.1+dfsg1-9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Docker.io is a widely used containerization platform that allows developers to automate the deployment of applications inside lightweight containers. It provides a consistent environment for applications, making it easier to develop, ship, and run software. However, in versions 19.03.x before 19.03.1, Docker.io is vulnerable to a code injection issue when linked against the GNU C Library (glibc), which can lead to severe security risks.
Vulnerability Detail
CVE-2019-14271 is a critical vulnerability that arises from the nsswitch facility dynamically loading libraries inside a chroot environment that contains the contents of the container. This flaw can be exploited to inject malicious code, potentially allowing attackers to execute arbitrary commands within the container, leading to unauthorized access and data breaches. The vulnerability has a CVSS score of 9.8, indicating its high severity and the urgent need for remediation.
How To Fix
Minimum fixed version
18.09.1+dfsg1-9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade docker.ioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the nsswitch facility or refrain from running Docker containers in a chroot environment until the upgrade is completed. Additionally, ensure that the environment is secured and monitored for any suspicious activity.
Conclusion
CVE-2019-14271 is a critical vulnerability in Docker.io that poses significant security risks due to potential code injection. Users are strongly advised to upgrade to the fixed version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for docker.io →
FAQ
CVE-2019-14271 is a critical vulnerability in Docker.io that allows code injection through the nsswitch facility when linked against glibc.
Docker.io versions 19.03.x before 19.03.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and execution of arbitrary commands within the container.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2019-14271 is 9.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for docker.io.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
