Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might have a data size that causes a denial of service to a bastion node. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
| Link | Resource |
|---|---|
| https://github.com/docker/machine/releases | Release Notes |
| https://hackerone.com/reports/1916285 | Exploit Third Party Advisory |
| https://vin01.github.io/piptagole/docker/security/gitlab/docker-machine/2023/07/07/docker-machine-attack-surface.html | Exploit Third Party Advisory |
Configurations
History
14 Nov 2023, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Docker machine
Docker |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:docker:machine:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-Other | |
| References | () https://github.com/docker/machine/releases - Release Notes | |
| References | () https://hackerone.com/reports/1916285 - Exploit, Third Party Advisory | |
| References | () https://vin01.github.io/piptagole/docker/security/gitlab/docker-machine/2023/07/07/docker-machine-attack-surface.html - Exploit, Third Party Advisory |
07 Nov 2023, 12:14
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-07 04:20
Updated : 2024-04-11 01:21
NVD link : CVE-2023-40453
Mitre link : CVE-2023-40453
CVE.ORG link : CVE-2023-40453
JSON object : View
Products Affected
docker
- machine
CWE