[Bug 1167505] New: CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation - golang - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

[Bug 1167505] New: CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

File go1.4.src.tar.gz uploaded to...

[Bug 1167506] New: CVE-2014-6408...

Red Hat Bugzilla

Monday, 24 November 2014 Mon, 24 Nov '14

6:15 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Bug ID: 1167505 Summary: CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mmcallis(a)redhat.com CC: admiller(a)redhat.com, dwalsh(a)redhat.com, golang(a)lists.fedoraproject.org, hushan.jia(a)gmail.com, jchaloup(a)redhat.com, jperrin(a)centos.org, lsm5(a)fedoraproject.org, mattdm(a)redhat.com, mgoldman(a)redhat.com, miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com, vbatts(a)redhat.com The following flaw has been fixed in Docker 1.3.2: "" The Docker engine, up to and including version 1.3.1, was vulnerable to extracting files to arbitrary paths on the host during ‘docker pull’ and ‘docker load’ operations. This was caused by symlink and hardlink traversals present in Docker's image extraction. This vulnerability could be leveraged to perform remote code execution and privilege escalation. Docker 1.3.2 remedies this vulnerability. Additional checks have been added to pkg/archive and image extraction is now performed in a chroot. No remediation is available for older versions of Docker and users are advised to upgrade. "" Acknowledgements: Red Hat would like to thank the Docker project for reporting these issues. Upstream acknowledges Florian Weimer of Red Hat Product Security and independent researcher Tõnis Tiigi as the original reporters. Reference: http://seclists.org/oss-sec/2014/q4/781 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Show replies by date

Red Hat Bugzilla

Monday, 24 November Mon, 24 Nov

6:17 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=4.4/AV:L/AC:M/ |stream,cvss2=4.4/AV:L/AC:M/ |Au:N/C:P/I:P/A:P,rhel-7/doc |Au:N/C:P/I:P/A:P,rhel-7/doc |ker=new,fedora-all/docker-i |ker=new,fedora-all/docker-i |o=affected |o=affected,epel-6/docker-io | |=affected -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

6:20 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1167507 Depends On| |1167508 --- Comment #1 from Murray McAllister <mmcallis(a)redhat.com> --- Created docker-io tracking bugs for this issue: Affects: fedora-all [bug 1167507] Affects: epel-6 [bug 1167508] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1167507 [Bug 1167507] CVE-2014-6407 docker-io: docker: symbolic and hardlink issues leading to privilege escalation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1167508 [Bug 1167508] CVE-2014-6407 docker-io: docker: symbolic and hardlink issues leading to privilege escalation [epel-6] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

6:24 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Murray McAllister <mmcallis(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1167510 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

7:07 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Trevor Jay <tjay(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=4.4/AV:L/AC:M/ |stream,cvss2=3.7/AV:L/AC:H/ |Au:N/C:P/I:P/A:P,rhel-7/doc |Au:M/C:N/I:C/A:N,rhel-7/doc |ker=new,fedora-all/docker-i |ker=affected,fedora-all/doc |o=affected,epel-6/docker-io |ker-io=affected,epel-6/dock |=affected |er-io=affected -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

7:20 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Trevor Jay <tjay(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tjay(a)redhat.com Fixed In Version|docker 1.3.2 | -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

7:20 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 --- Comment #2 from Trevor Jay <tjay(a)redhat.com> --- This issue affects the versions of Docker as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low security impact. A future update will address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Red Hat does not support or recommend running untrusted images. -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

9:35 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Trevor Jay <tjay(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=3.7/AV:L/AC:H/ |stream,cvss2=3.7/AV:L/AC:H/ |Au:M/C:N/I:C/A:N,rhel-7/doc |Au:M/C:N/I:C/A:N,rhel-7/doc |ker=affected,fedora-all/doc |ker=defer,fedora-all/docker |ker-io=affected,epel-6/dock |-io=defer,epel-6/docker-io= |er-io=affected |defer -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Tuesday, 25 November Tue, 25 Nov

1:15 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |docker 1.3.2 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:04 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=3.7/AV:L/AC:H/ |stream,cvss2=3.7/AV:L/AC:H/ |Au:M/C:N/I:C/A:N,rhel-7/doc |Au:M/C:N/I:C/A:N,rhel-7/doc |ker=defer,fedora-all/docker |ker=defer,fedora-all/docker |-io=defer,epel-6/docker-io= |-io=affected,epel-6/docker- |defer |io=affected -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:11 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Florian Weimer <fweimer(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1133085 CC| |vdanen(a)redhat.com --- Comment #3 from Florian Weimer <fweimer(a)redhat.com> --- *** Bug 1133084 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Wednesday, 3 December Wed, 3 Dec

11:16 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Bug 1167505 depends on bug 1167507, which changed state. Bug 1167507 Summary: CVE-2014-6408 CVE-2014-6407 docker-io: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1167507 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

11:16 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 --- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> --- docker-io-1.3.2-2.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Wednesday, 10 December Wed, 10 Dec

1 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Trevor Jay <tjay(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=3.7/AV:L/AC:H/ |stream,cvss2=3.7/AV:L/AC:H/ |Au:M/C:N/I:C/A:N,rhel-7/doc |Au:M/C:N/I:C/A:N,rhel-7/doc |ker=defer,fedora-all/docker |ker=affected,fedora-all/doc |-io=affected,epel-6/docker- |ker-io=affected,epel-6/dock |io=affected |er-io=affected -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:42 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 --- Comment #5 from Trevor Jay <tjay(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extras Via RHSA-2014:1947 https://rhn.redhat.com/errata/RHBA-2014-1977.html -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

3:48 p.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Vincent Danen <vdanen(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2014-12-10 16:48:37 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

Thursday, 11 December Thu, 11 Dec

12:34 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Bug 1167505 depends on bug 1167508, which changed state. Bug 1167508 Summary: CVE-2014-6408 CVE-2014-6407 docker-io: various flaws [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1167508 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Red Hat Bugzilla

2:45 a.m.

New subject: [Bug 1167505] CVE-2014-6407 docker: symbolic and hardlink issues leading to privilege escalation

https://bugzilla.redhat.com/show_bug.cgi?id=1167505 Ján Rusnačko <jrusnack(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack(a)redhat.com Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20141114,source=up |reported=20141114,source=up |stream,cvss2=3.7/AV:L/AC:H/ |stream,cvss2=3.7/AV:L/AC:H/ |Au:M/C:N/I:C/A:N,rhel-7/doc |Au:M/C:N/I:C/A:N,rhel-7/doc |ker=affected,fedora-all/doc |ker=affected,fedora-all/doc |ker-io=affected,epel-6/dock |ker-io=affected,epel-6/dock |er-io=affected |er-io=affected,cwe=CWE-59 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

3438

days inactive

3454

days old

golang@lists.fedoraproject.org

Manage subscription

17 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla