Directory Traversal Vulnerability in golang-github-appc-docker2aci Package
Summary
DEBIAN-CVE-2016-7569: Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. Affects golang-github-appc-docker2aci versions < 0.14.0+dfsg-1. Fixed in 0.14.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The golang-github-appc-docker2aci package is a tool that converts Docker images into ACI (Application Container Image) format. It is widely used in containerization workflows to facilitate the deployment of applications. However, prior to version 0.14.0+dfsg-1, this package is susceptible to a directory traversal vulnerability that can be exploited by attackers.
Vulnerability Detail
The directory traversal vulnerability in docker2aci versions before 0.13.0 allows remote attackers to manipulate the embedded layer data in an image. By using a '..' (dot dot) sequence, an attacker can write to arbitrary files on the server, potentially leading to unauthorized access, data corruption, or system compromise. This vulnerability poses a significant risk, especially in environments where untrusted images are processed.
How To Fix
Minimum fixed version
0.14.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-appc-docker2aciTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the affected service or implementing file system permissions that prevent unauthorized file writes. Additionally, avoid processing untrusted Docker images until the package is updated.
Conclusion
The directory traversal vulnerability in the golang-github-appc-docker2aci package poses a serious risk to systems that utilize this tool for Docker image conversion. It is crucial to update to the patched version to mitigate potential threats. Users should remain vigilant and monitor their systems for any signs of exploitation.
See every vulnerability recorded for golang-github-appc-docker2aci →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file access and manipulation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
Exploiting this vulnerability can lead to unauthorized access to sensitive files, data corruption, or even full system compromise, depending on the permissions of the affected application.
Yes, a patch is available in version 0.14.0+dfsg-1 of the golang-github-appc-docker2aci package. Updating to this version will resolve the vulnerability.
If you cannot update immediately, consider implementing strict file permissions and restricting access to the service until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-appc-docker2aci.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
