CVE-2020-27534
Published: 30 December 2020
util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call.
Notes
| Author | Note |
|---|---|
| mdeslaur | the patch looks like a windows-specific issue, the description is "Avoid creation of irrelevant temporary files on Windows." and it basically only modified Windows code. Marking as not-affected. |
Priority
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.3 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
References
- http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes/
- https://github.com/moby/buildkit/pull/1462
- https://github.com/moby/moby/pull/40877
- https://golang.org/pkg/io/ioutil/#TempDir
- https://golang.org/pkg/os/#TempDir
- https://www.cve.org/CVERecord?id=CVE-2020-27534
- NVD
- Launchpad
- Debian