Insecure dynamic library loading in Docker - CVE-2019-14271
Published: September 10, 2019 / Updated: March 16, 2023
Vulnerability identifier: #VU20969
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14271
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to the application loads NSS libraries in docker cp
in an insecure manner. A local attacker can pass a specially crafted library file to the application and execute arbitrary code on the system with elevated privileges.
Affected software
Docker
IBM Cloud Automation Manager
docker.io (Debian package)
docker (Alpine package)
IBM Cloud Automation Manager
docker.io (Debian package)
docker (Alpine package)
How to mitigate CVE-2019-14271
Install updates from vendor's website.
Docker - update to 19.03.1
docker.io (Debian package) - update to 18.09.1+dfsg1-7.1+deb10u1
docker (Alpine package) - update to 19.03.1-r1
docker.io (Debian package) - update to 18.09.1+dfsg1-7.1+deb10u1
docker (Alpine package) - update to 19.03.1-r1