CVE-2020-14300

CVSS V2 Medium 4.6 CVSS V3 High 8.8
Description
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected.
Overview
  • CVE ID
  • CVE-2020-14300
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2020-07-13T22:15:12
  • Last Modified Date
  • 2023-02-12T23:39:55
Weakness Enumerations
CWE URL
CWE-273 http://cwe.mitre.org/data/definitions/273.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:docker:docker:1.13.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.6
  • Severity
  • MEDIUM
  • Exploitability Score
  • 3.9
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • CHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2
  • Impact Score
  • 6
References
Reference URL Reference Tags
https://access.redhat.com/errata/RHBA-2020:0427 Vendor Advisory
https://access.redhat.com/errata/RHSA-2020:2653
https://access.redhat.com/security/cve/CVE-2016-9962 Not Applicable
https://access.redhat.com/security/cve/CVE-2020-14300
https://access.redhat.com/security/vulnerabilities/cve-2016-9962 Not Applicable
https://access.redhat.com/security/vulnerabilities/runc-regression-docker-1.13.1-108
https://bugzilla.redhat.com/show_bug.cgi?id=1848829
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9962 Not Applicable
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-14300
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14300
History
Created Old Value New Value Data Type Notes
2022-05-10 16:40:19 Added to TrackCVE
2022-12-04 19:23:46 2020-07-13T22:15Z 2020-07-13T22:15:12 CVE Published Date updated
2022-12-04 19:23:46 2020-07-21T19:32:25 CVE Modified Date updated
2022-12-04 19:23:46 Analyzed Vulnerability Status updated
2023-02-02 23:10:37 2023-02-02T21:19:33 CVE Modified Date updated
2023-02-02 23:10:37 Analyzed Modified Vulnerability Status updated
2023-02-02 23:10:38 The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected. The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2016-9962, which was previously fixed via RHSA-2017:0116. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. Description updated
2023-02-02 23:10:39 References updated
2023-02-13 00:11:18 2023-02-12T23:39:55 CVE Modified Date updated
2023-02-13 00:11:18 The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2016-9962, which was previously fixed via RHSA-2017:0116. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected. Description updated