Skip to content

x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-g7v2-2qxx-wjrw #649

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-g7v2-2qxx-wjrw #649

julieqiu opened this issue Aug 1, 2022 · 3 comments
Assignees
@julieqiu
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-g7v2-2qxx-wjrw, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/docker/docker 1.6.1 < 1.6.1

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/docker/docker
    versions:
      - fixed: 1.6.1
description: Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor
    passed to the pid-1 process before performing the chroot, which allows local users
    to gain privileges via a symlink attack in an image.
published: 2022-02-15T01:18:02Z
last_modified: 2022-02-15T01:18:02Z
cves:
  - CVE-2015-3627
ghsas:
  - GHSA-g7v2-2qxx-wjrw
links:
    context:
      - https://github.com/advisories/GHSA-g7v2-2qxx-wjrw
@julieqiu julieqiu self-assigned this Aug 3, 2022
@julieqiu
Copy link
Member Author

julieqiu commented Aug 3, 2022

Vulnerability in tool. Not importable.

@julieqiu julieqiu closed this as completed Aug 3, 2022
@neild neild added excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. and removed NotGoVuln labels Aug 10, 2022
This was referenced Apr 4, 2023
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Aug 15, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Oct 30, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 20, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 18, 2024
Closed
This was referenced Jun 10, 2024
Closed
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

@tatianab tatianab mentioned this issue Aug 1, 2024
Open
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607223 mentions this issue: data/reports: unexclude 20 reports (21)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (21)
e715f25 
  - data/reports/GO-2022-0642.yaml
  - data/reports/GO-2022-0644.yaml
  - data/reports/GO-2022-0645.yaml
  - data/reports/GO-2022-0647.yaml
  - data/reports/GO-2022-0649.yaml
  - data/reports/GO-2022-0700.yaml
  - data/reports/GO-2022-0703.yaml
  - data/reports/GO-2022-0704.yaml
  - data/reports/GO-2022-0705.yaml
  - data/reports/GO-2022-0707.yaml
  - data/reports/GO-2022-0708.yaml
  - data/reports/GO-2022-0709.yaml
  - data/reports/GO-2022-0732.yaml
  - data/reports/GO-2022-0749.yaml
  - data/reports/GO-2022-0751.yaml
  - data/reports/GO-2022-0752.yaml
  - data/reports/GO-2022-0759.yaml
  - data/reports/GO-2022-0760.yaml
  - data/reports/GO-2022-0769.yaml
  - data/reports/GO-2022-0770.yaml

Updates #642
Updates #644
Updates #645
Updates #647
Updates #649
Updates #700
Updates #703
Updates #704
Updates #705
Updates #707
Updates #708
Updates #709
Updates #732
Updates #749
Updates #751
Updates #752
Updates #759
Updates #760
Updates #769
Updates #770

Change-Id: I3dabcc907fd498009a9bd4cf865198037615717e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607223
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@julieqiu julieqiu

Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @julieqiu @gopherbot