Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-13509

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

Published

2019-07-18T16:15:11.953

Last Modified

2024-11-21T04:25:02.213

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-532
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application docker docker < 18.09.8 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.03.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 17.06.2 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker 18.03.1 Yes
Application docker docker < 18.09.8 Yes
References