Command Injection

🗓️ 25 Jul 2019 07:17:26Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 45 Views

github.com/moby/moby vulnerable to command injection through misinterpretation of 'git ref' command as flag, allowing remote code execution via docker build path

Reporter	Title	Published	Views	Family All 46
ATTACKERKB	CVE-2019-13139	22 Aug 201920:15	–	attackerkb
Amazon	Medium: docker	4 Nov 201900:00	–	amazon
Amazon	Medium: docker	18 Nov 202100:00	–	amazon
Amazon	Medium: docker	18 Nov 202100:00	–	amazon
Tenable Nessus	Amazon Linux AMI : docker (ALAS-2019-1316)	7 Nov 201900:00	–	nessus
Tenable Nessus	Debian DSA-4521-1 : docker.io - security update	10 Sep 201900:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2020-0082)	9 Dec 202000:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2021-0138)	27 Oct 202100:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.06 : docker-ce Multiple Vulnerabilities (NS-SA-2025-0217)	30 Sep 202500:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.06 (SP) : docker-ce Multiple Vulnerabilities (NS-SA-2026-0011)	6 Mar 202600:00	–	nessus

Vulners

Node

mobyproject github.com/moby/mobyRange1.7.0-rc1–17.05.0-cego

mobyproject github.com/moby/mobyMatchheadgo

mobyproject github.com/moby/mobyMatchdocs-v1.10-docs-v1.12go

docker dockerMatch1.13.1_94.gitb2f74b2.el7.centos

docker dockerMatch1.13.1_102.git7f2769b.el7.centos

docker dockerMatch1.13.1_68.gitdded712.el7.centos

docker dockerMatch1.13.1_103.git7f2769b.el7.centos

docker dockerMatch1.13.1_93.gitb2f74b2.el7

docker dockerMatch1.13.1_91.git07f3374.el7.centos

docker dockerMatch1.13.1_53.git774336d.el7.centos

docker dockerMatch1.13.1_58.git87f2fab.el7.centos

docker dockerMatch1.13.1_96.gitb2f74b2.el7.centos

docker dockerMatch1.13.1_84.git07f3374.el7.centos

docker dockerMatch1.13.1_74.git6e3bb8e.el7.centos

docker dockerMatch1.6.2_8.el7

docker dockerMatch1.9.1_25.1.origin.el7

docker dockerMatch1.13.1_63.git94f4240.el7.centos

docker dockerMatch1.13.1_88.git07f3374.el7.centos

docker dockerMatch1.13.1_47.2.gitf43d177.el7

docker dockerMatch1.13.1_75.git8633870.el7.centos

docker dockerMatch1.10.3_59.1.el7

docker dockerMatch1.12.6_79.git5680db5.el7

Source	Link
docs	www.docs.docker.com/engine/release-notes/
github	www.github.com/docker/docker.github.io/commit/6c5f477ca10f3cbf2081b044be4987bb0098afdd
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/moby/moby/pull/38944
seclists	www.seclists.org/bugtraq/2019/Sep/21
debian	www.debian.org/security/2019/dsa-4521
security	www.security.netapp.com/advisory/ntap-20190910-0001/
staaldraad	www.staaldraad.github.io/post/2019-07-16-cve-2019-13139-docker-build/
github	www.github.com/docker/docker.github.io/blob/master/engine/release-notes.md
access	www.access.redhat.com/errata/RHBA-2019:3092

15 May 2023 05:37Current

8.2High risk

Vulners AI Score8.2

CVSS 24.6

CVSS 38.4

EPSS0.00548