CVE-2019-13509

Published: 18 July 2019

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
docker.io Launchpad, Ubuntu, Debian	bionic	Not vulnerable (18.09.7-0ubuntu1)
	disco	Not vulnerable (18.09.7-0ubuntu1)
	trusty	Does not exist
	upstream	Released (18.09.1+dfsg1-8)
	xenial	Not vulnerable (18.09.7-0ubuntu1)

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›