CVE-2019-13509

CVSS V2 Medium 5 CVSS V3 High 7.5
Description
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
Overview
  • CVE ID
  • CVE-2019-13509
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2019-07-18T16:15:11
  • Last Modified Date
  • 2019-08-27T17:15:10
Weakness Enumerations
CWE URL
CWE-532 http://cwe.mitre.org/data/definitions/532.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:docker:docker:*:*:*:*:enterprise:*:*:* 1 OR 18.09.0 18.09.8
cpe:2.3:a:docker:docker:17.03.2:1:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:2:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:3:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:4:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:5:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:6:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:7:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.03.2:8:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:1:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:10:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:11:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:12:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:13:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:15:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:16:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:17:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:18:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:19:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:2:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:20:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:21:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:22:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:3:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:4:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:5:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:6:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:7:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:8:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:17.06.2:9:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:1:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:2:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:3:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:4:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:5:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:6:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:7:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:8:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:18.03.1:9:*:*:enterprise:*:*:* 1 OR
cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:* 1 OR 18.09.8
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 5
  • Severity
  • MEDIUM
  • Exploitability Score
  • 10
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • NONE
  • Base Score
  • 7.5
  • Base Severity
  • HIGH
  • Exploitability Score
  • 3.9
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
https://docs.docker.com/engine/release-notes/ Release Notes Vendor Advisory
http://www.securityfocus.com/bid/109253 Third Party Advisory VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/
https://security.netapp.com/advisory/ntap-20190828-0003/
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
https://www.debian.org/security/2019/dsa-4521
https://seclists.org/bugtraq/2019/Sep/21
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2019-13509
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13509
History
Created Old Value New Value Data Type Notes
2022-05-10 07:47:34 Added to TrackCVE
2022-12-03 23:28:20 2019-07-18T16:15Z 2019-07-18T16:15:11 CVE Published Date updated
2022-12-03 23:28:20 2019-08-27T17:15:10 CVE Modified Date updated
2022-12-03 23:28:20 Modified Vulnerability Status updated