CVE-2019-13139
- State
- Published
- Severity
- Not scored
- Published
- Aug 22, 2019
- Updated
- Aug 4, 2024
- Reserved
- Jul 1, 2019
Description
In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/moby/moby/pull/38944
- https://docs.docker.com/engine/release-notes/#18094
- https://staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/
- DSA-4521vendor-advisory
- https://security.netapp.com/advisory/ntap-20190910-0001/
- 20190910 [SECURITY] [DSA 4521-1] docker.io security updatemailing-list
- RHBA-2019:3092vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.