CVE-2014-9357: Arbitrary Code Execution in github.com/docker/docker
Summary
CVE-2014-9357: Arbitrary Code Execution in github.com/docker/docker. Affects github.com/docker/docker versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2014-9357 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/docker/docker, which is written in Go. It is a popular open-source containerization platform that allows users to automate the deployment and management of applications within containers. Docker provides an easy-to-use interface for creating, running, and managing containers, making it a widely adopted tool in the software development and deployment process.
Vulnerability Detail
The vulnerability identified as CVE-2014-9357 allows for arbitrary code execution in github.com/docker/docker. This vulnerability can be exploited by an attacker to execute malicious code within a Docker container, potentially leading to unauthorized access, data breaches, or further compromise of the host system. The vulnerability originates from a flaw in the package's code, which allows an attacker to bypass certain security measures and execute arbitrary commands.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the package to the latest secure version.
Conclusion
The vulnerability CVE-2014-9357 in github.com/docker/docker allows for arbitrary code execution, posing a significant security risk to Docker container environments. It is crucial to update the package to version 1.3.3 or higher to mitigate this vulnerability and prevent potential unauthorized access or data breaches. Additionally, following security best practices and regularly monitoring for vulnerabilities can help maintain a secure containerization environment.
See every vulnerability recorded for github.com/docker/docker →
FAQ
This vulnerability allows an attacker to execute arbitrary code within a Docker container, potentially leading to unauthorized access, data breaches, or further compromise of the host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file without requiring access to the code or installation.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the package to the latest secure version.
You can update the github.com/docker/docker package by running the appropriate package manager command or manually downloading and installing the updated version from the official repository.
In addition to updating the package, it is recommended to follow security best practices such as regularly monitoring for vulnerabilities, applying security patches promptly, and implementing strong access controls and network security measures.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
