CVE-2019-13139

In Docker before 18.09.4, an attacker who is capable of supplying or
manipulating the build path for the “docker build” command would be able to
gain command execution. An issue exists in the way “docker build” processes
remote git URLs, and results in command injection into the underlying “git
clone” command, leading to code execution in the context of the user
executing the “docker build” command. This occurs because git ref can be
misinterpreted as a flag.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933002&gt;