Vulnerability Description
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker | < 18.09.4 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHBA-2019:3092
- https://docs.docker.com/engine/release-notes/#18094Release NotesVendor Advisory
- https://github.com/moby/moby/pull/38944PatchThird Party Advisory
- https://seclists.org/bugtraq/2019/Sep/21
- https://security.netapp.com/advisory/ntap-20190910-0001/
- https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/ExploitThird Party Advisory
- https://www.debian.org/security/2019/dsa-4521
- https://access.redhat.com/errata/RHBA-2019:3092
- https://docs.docker.com/engine/release-notes/#18094Release NotesVendor Advisory
- https://github.com/moby/moby/pull/38944PatchThird Party Advisory
- https://seclists.org/bugtraq/2019/Sep/21
- https://security.netapp.com/advisory/ntap-20190910-0001/
- https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/ExploitThird Party Advisory
- https://www.debian.org/security/2019/dsa-4521
FAQ
What is CVE-2019-13139?
CVE-2019-13139 is a vulnerability with a CVSS score of 8.4 (HIGH). In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "doc...
How severe is CVE-2019-13139?
CVE-2019-13139 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13139?
Check the references section above for vendor advisories and patch information. Affected products include: Docker Docker.