<p>Upgrade <code>SLES:15.0</code> <code>docker</code> to version 18.06.1_ce-6.8.2 or higher.</p>

Improper Input Validation Affecting docker package, versions <18.06.1_ce-6.8.2

Threat Intelligence

1.52% (88^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-SLES150-DOCKER-2757764
published 14 Apr 2022
disclosed 28 Dec 2018

Report a new vulnerability Found a mistake?

Introduced: 28 Dec 2018

CVE-2018-16874 Open this link in a new tab CWE-20 Open this link in a new tab

How to fix?

Upgrade SLES:15.0 docker to version 18.06.1_ce-6.8.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream docker package and not the docker package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High