Directory Traversal Affecting docker.io package, versions <1.3.3~dfsg1-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.16% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Directory Traversal vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIANUNSTABLE-DOCKERIO-301910
  • published27 Jun 2018
  • disclosed2 Dec 2019

Introduced: 27 Jun 2018

CVE-2014-9356  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Debian:unstable docker.io to version 1.3.3~dfsg1-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream docker.io package and not the docker.io package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

CVSS Scores

version 3.1