This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2014-9358 →

DEBIAN-CVE-2014-9358

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a...

Original description

The description as published by the source.

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 docker.io

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3~dfsg1-1"}]}]

Debian:13 docker.io

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3~dfsg1-1"}]}]

Debian:14 docker.io

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3~dfsg1-1"}]}]

References

advisory security-tracker.debian.org