CVE-2014-9356: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

May 18, 2021

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

References

access.redhat.com/security/cve/cve-2014-9356
github.com/advisories/GHSA-vj3f-3286-r4pf
nvd.nist.gov/vuln/detail/CVE-2014-9356
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9356

Code Behaviors & Features

Detect and mitigate CVE-2014-9356 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →