MEDIUM 6.5 Microsoft
CVE-2017-14992
Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0 1.10.3 17.03.0 17.03.1 17.03.2 17.06.0 17.06.1 17.06.2 17.09.0 and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload aka gzip bombing.
Microsoft Security Update 2017-Nov: Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0 1.10.3 17.03.0 17.03.1 17.03.2 17.06.0 17.06.1 17.06.2 17.09.0 and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload aka gzip bombing.
Affected Products
- cm1 moby-buildx 0.4.1+azure-3 on CBL Mariner 1.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-14992
- https://nvd.nist.gov/vuln/detail/CVE-2017-14992
This medium severity vulnerability with a CVSS score of 6.5 was published on 2017-11-14 via Microsoft. Affected: cm1 moby-buildx 0.4.1+azure-3 on CBL Mariner 1.0.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.