Directory Traversal Vulnerability in golang-github-appc-docker2aci: Risk of Arbitrary File Write
Summary
CVE-2016-7569: Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. Affects golang-github-appc-docker2aci across 2 version ranges.
< 0.14.0+dfsg-1
< 0cac1a3ecc114941cf643ec25f4daaeee8c3d538
Fixed in 0.14.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-appc-docker2aci package is a tool that facilitates the conversion of Docker images to ACI (Application Container Image) format. It is widely used in containerized environments to ensure compatibility across different container orchestration systems. However, this package has a vulnerability that allows attackers to exploit directory traversal, potentially leading to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2016-7569, arises from improper handling of embedded layer data in Docker images. By using a '..' (dot dot) sequence, an attacker can traverse directories and write to arbitrary files on the host system. This could lead to significant security risks, including data corruption, unauthorized access to sensitive files, and potential system compromise. The vulnerability affects versions prior to 0.13.0 and has a CVSS score of 5.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0.14.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-appc-docker2aciTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict access to the affected application or limit its execution context to minimize exposure. Additionally, monitor logs for any suspicious activity that may indicate attempts to exploit this vulnerability.
Conclusion
The directory traversal vulnerability in golang-github-appc-docker2aci poses a significant risk to systems using this package. Immediate action is required to upgrade to a secure version to prevent potential exploitation. Utilizing tools like Vulert can enhance your security posture by providing real-time vulnerability monitoring.
See every vulnerability recorded for golang-github-appc-docker2aci →
FAQ
CVE-2016-7569 is a directory traversal vulnerability in the golang-github-appc-docker2aci package that allows attackers to write to arbitrary files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized file access, data corruption, and potential system compromise due to arbitrary file writes.
It is recommended to upgrade to version 0.14.0+dfsg-1 or later to mitigate the vulnerability.
Yes, using tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-appc-docker2aci.
