Docker has been found vulnerable to a symlink-race attack in the API behind “docker cp”. Some information on this has been published publicly already. Attackers can gain read-write access to the host filesystem with root privileges. A patch is not available yet, one has been produced by the original reporter, but is undergoing code review.
More information can be found in the SVG alert sent to all EGI sites
Recent Comments