CVE-2019-1020014 : docker-credential-helpers before 0.6.3 has a double free in the List functions.

docker-credential-helpers before 0.6.3 has a double free in the List functions.

Published 2019-07-29 13:15:12

Updated 2022-10-06 20:20:30

Source DWF

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2019-1020014

Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 19.04
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Docker » Credential Helpers
Versions before (<) 0.6.3
cpe:2.3:a:docker:credential_helpers:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-415 Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Assigned by: nvd@nist.gov (Primary)

https://github.com/docker/docker-credential-helpers/commit/1c9f7ede70a5ab9851f4c9cb37d317fd89cd318a

Merge pull request from GHSA-g9w7-h2f5-5vp2 · docker/docker-credential-helpers@1c9f7ed · GitHub
Patch;Third Party Advisory
https://usn.ubuntu.com/4103-2/

USN-4103-2: Docker vulnerability | Ubuntu security notices
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6VVFB6UWUK2GQQN7DVUU6GRRAL637A73/

[SECURITY] Fedora 32 Update: golang-github-docker-credential-helpers-0.6.3-2.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://usn.ubuntu.com/4103-1/

USN-4103-1: docker-credential-helpers vulnerability | Ubuntu security notices
Third Party Advisory
https://github.com/docker/docker-credential-helpers/releases/tag/v0.6.3

Release Release v0.6.3 - security fix · docker/docker-credential-helpers · GitHub
Release Notes;Third Party Advisory

Jump to