In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4827 advisory.

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur     when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the     container. (CVE-2019-14271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the docker package has been released.

Three security vulnerabilities have been discovered in the Docker container runtime: Insecure loading of NSS libraries in 'docker cp'could result in execution of code with root privileges, sensitive data could be logged in debug mode and there was a command injection vulnerability in the 'docker build' command.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues :

Docker :

  - CVE-2019-14271: Fixed a code injection if the nsswitch     facility dynamically loaded a library inside a chroot     (bsc#1143409).

  - CVE-2019-13509: Fixed an information leak in the debug     log (bsc#1142160).

  - Update to version 19.03.1-ce, see changelog at     /usr/share/doc/packages/docker/CHANGELOG.md     (bsc#1142413, bsc#1139649).

runc :

  - Use %config(noreplace) for /etc/docker/daemon.json     (bsc#1138920).

  - Update to runc 425e105d5a03, which is required by Docker     (bsc#1139649).

containerd :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (bsc#1121967).

  - Update to containerd v1.2.6, which is required by docker     (bsc#1139649).

golang-github-docker-libnetwork :

  - Update to version     git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is     required by docker (bsc#1142413, bsc#1139649).

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues :

Docker :

CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).

CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).

Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649).

runc: Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920).

Update to runc 425e105d5a03, which is required by Docker (bsc#1139649).

containerd: CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967).

Update to containerd v1.2.6, which is required by docker (bsc#1139649).

golang-github-docker-libnetwork: Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180695	Oracle Linux 7 : docker-engine / docker-cli (ELSA-2019-4827)	Nessus	Oracle Linux Local Security Checks	critical
132677	Photon OS 2.0: Docker PHSA-2019-2.0-0193	Nessus	PhotonOS Local Security Checks	critical
128622	Debian DSA-4521-1 : docker.io - security update	Nessus	Debian Local Security Checks	critical
128409	openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2019-2021)	Nessus	SuSE Local Security Checks	critical
127884	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2019:2117-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-14271

critical

Tenable Plugins

critical

critical

critical

critical

critical