docker.io: CVE-2019-13509

Debian Bug report logs - #932673
docker.io: CVE-2019-13509

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: docker.io: CVE-2019-13509

Date: Sun, 21 Jul 2019 21:32:34 +0200

Source: docker.io
Version: 18.09.1+dfsg1-7.1
Severity: normal
Tags: security upstream
Control: found -1 18.09.5+dfsg1-1

Hi,

The following vulnerability was published for docker.io. If I do
understand the isuse correctly, then I do not think there is any
urgend action to be taken for buster, it might be fixed in a point
release.

CVE-2019-13509[0]:
| In Docker CE and EE before 18.09.8 (as well as Docker EE before
| 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug
| mode may sometimes add secrets to the debug log. This applies to a
| scenario where docker stack deploy is run to redeploy a stack that
| includes (non external) secrets. It potentially applies to other API
| users of the stack API if they resend the secret.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13509
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13509

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.