Bug 1172787 (CVE-2014-9358)

Summary:	CVE-2014-9358 docker: Path traversal and spoofing opportunities presented through image identifiers
Product:	[Other] Security Response	Reporter:	Trevor Jay <tjay>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dwalsh, lsm5, lsu, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	docker 1.3.3	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-12-11 21:02:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1173324, 1173325
Bug Blocks:	1172847

Description Trevor Jay 2014-12-10 18:09:54 UTC

Docker Inc. has reported that it is possible to spoof images on the central registry. From the report: 

"It has been discovered that Docker does not sufficiently validate Image IDs as provided either via 'docker load' or through registry communications. This allows for path traversal attacks, causing graph corruption and manipulation by malicious images, as well as repository spoofing attacks."

Comment 1 Vincent Danen 2014-12-11 20:53:13 UTC

External References:

https://groups.google.com/forum/#!topic/docker-user/nFAz-B-n4Bw

Comment 2 Vincent Danen 2014-12-11 21:01:35 UTC

Created docker-io tracking bugs for this issue:

Affects: fedora-all [bug 1173324]
Affects: epel-6 [bug 1173325]

Comment 3 Vincent Danen 2014-12-11 21:02:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2014:1947 https://rhn.redhat.com/errata/RHBA-2014-1977.html

Comment 4 Trevor Jay 2014-12-12 02:01:08 UTC

Acknowledgements:

Red Hat would like to thank Docker Inc. for reporting this issue.

Comment 5 Fedora Update System 2014-12-15 04:32:46 UTC

docker-io-1.4.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-01-26 02:35:31 UTC

docker-io-1.4.1-6.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.