oss-sec mailing list archives
Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier
From: Eric Windisch <ewindisch () docker com>
Date: Tue, 24 Mar 2015 16:07:19 -0400
tjay@ (our docker guy) verified they were fixed as you can see from his comments in the bugs. This is an example of why we need to clean these old things out. Nobody really cares about them, and in all likelihood they got fixed by upstream
It would seem so, yes. For the 'tmp' issue, we were contacted at Docker about tmp directory usage during building or running of tests for Docker itself. It is not clear if CVE-2014-0047 is a reflection of this, but it appears so. In that specific case, we performed triage and determined that either no such abuses of tmp existed at the time, or that those uses of tmp were run within containers in such a way that no vulnerability existed.
(CVE-2014-0048) Could this be a dupe of the index.docker.io registry misconfiguration that had at least one redirect to http:// (now fixed) for the actual (unverified) image data?No, this was stuff like downloading debian signing keys over http rather than https, and other sensitive content in similarly unsafe ways.
From the descriptions I've read here, I had also thought this was a
duplicate of CVE-2014-5277 (HTTP downgrade attack against registry). Both of these reports precede the establishment of a focused security team and process at Docker. Regards, Eric Windisch
Current thread:
- 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 23)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Eric Windisch (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Trevor Jay (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 31)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 24)