CVE-2019-13139
CVE-2019-13139
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.
CVSS 8.4 · High · EPSS 2.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
docker.io Debian:12
- Affected ranges
- ECOSYSTEM: < 18.09.1+dfsg1-8
Update to 18.09.1+dfsg1-8
docker.io Debian:13
- Affected ranges
- ECOSYSTEM: < 18.09.1+dfsg1-8
Update to 18.09.1+dfsg1-8
docker.io Debian:14
- Affected ranges
- ECOSYSTEM: < 18.09.1+dfsg1-8
Update to 18.09.1+dfsg1-8
Original sources
- https://github.com/moby/moby/pull/38944
- https://docs.docker.com/engine/release-notes/#18094
- https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/
- https://www.debian.org/security/2019/dsa-4521
- https://security.netapp.com/advisory/ntap-20190910-0001/
- https://seclists.org/bugtraq/2019/Sep/21
- https://access.redhat.com/errata/RHBA-2019:3092
- https://nvd.nist.gov/vuln/detail/CVE-2019-13139