Skip to content

docker-engine CVE-2021-41089

Low
tjkirch published GHSA-v6x9-36m9-hxh8 Oct 6, 2021

Package

docker-engine (bottlerocket)

Affected versions

< 1.3.0

Patched versions

1.3.0

Description

A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.

Severity

Low

CVE ID

CVE-2021-41089

Weaknesses

No CWEs