7.5

CVE-2019-13509

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Docker ≫ Docker SwEdition enterprise Version >= 18.09.0 < 18.09.8
Docker ≫ Docker Version 17.03.2 Update 1 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 2 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 3 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 4 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 5 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 6 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 7 SwEdition enterprise
Docker ≫ Docker Version 17.03.2 Update 8 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 1 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 10 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 11 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 12 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 13 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 15 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 16 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 17 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 18 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 19 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 2 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 20 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 21 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 22 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 3 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 4 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 5 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 6 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 7 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 8 SwEdition enterprise
Docker ≫ Docker Version 17.06.2 Update 9 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 1 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 2 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 3 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 4 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 5 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 6 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 7 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 8 SwEdition enterprise
Docker ≫ Docker Version 18.03.1 Update 9 SwEdition enterprise
Docker ≫ Docker SwEdition community Version < 18.09.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.65% 0.882
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
http://www.securityfocus.com/bid/109253
Third Party Advisory
VDB Entry
https://docs.docker.com/engine/release-notes/
Vendor Advisory
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/
https://seclists.org/bugtraq/2019/Sep/21
https://security.netapp.com/advisory/ntap-20190828-0003/
https://www.debian.org/security/2019/dsa-4521