Command Injection in Docker Engine - CVE-2019-13139
Published: September 10, 2019
Vulnerability identifier: #VU20954
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2019-13139
CWE-ID: CWE-77
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Docker Inc.
Affected software:
Docker Engine
Docker Engine
Detailed vulnerability description
The vulnerability allows a local attacker to inject and execute arbitrary commands on the target system.
The vulnerability exists due to the affected software misinterprets the "git ref" command as a flag. A local authenticated user who is able to execute the "docker build" command and has control over the build path can inject and execute arbitrary commands on the target system.
How to mitigate CVE-2019-13139
Install updates from vendor's website.