Read the docs
TI-2018-11159 Aliases CVE-2018-15664GHSA-pv79-5r2c-jrpq

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are…

Priority LOW 39CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

Why it matters now

EPSS 0.03427 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 64

CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:17.06.0-ce:*:*:*:community:*:*:*17.06.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.06.0-ce:rc1:*:*:community:*:*:*17.06.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.06.0-ce:rc2:*:*:community:*:*:*17.06.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.06.0-ce:rc3:*:*:community:*:*:*17.06.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:17.06.0-ce:rc4:*:*:community:*:*:*17.06.0-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:17.06.0-ce:rc5:*:*:community:*:*:*17.06.0-ce rc5VulnerableDocker
cpe:2.3:a:docker:docker:17.06.1-ce:*:*:*:community:*:*:*17.06.1-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.06.1-ce:rc1:*:*:community:*:*:*17.06.1-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.06.1-ce:rc2:*:*:community:*:*:*17.06.1-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.06.1-ce:rc3:*:*:community:*:*:*17.06.1-ce rc3VulnerableDocker
  • cpe:2.3:a:docker:docker:17.06.0-ce:*:*:*:community:*:*:* Versions 17.06.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.0-ce:rc1:*:*:community:*:*:* Versions 17.06.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.0-ce:rc2:*:*:community:*:*:* Versions 17.06.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.0-ce:rc3:*:*:community:*:*:* Versions 17.06.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.0-ce:rc4:*:*:community:*:*:* Versions 17.06.0-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.0-ce:rc5:*:*:community:*:*:* Versions 17.06.0-ce rc5 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.1-ce:*:*:*:community:*:*:* Versions 17.06.1-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.1-ce:rc1:*:*:community:*:*:* Versions 17.06.1-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.1-ce:rc2:*:*:community:*:*:* Versions 17.06.1-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.1-ce:rc3:*:*:community:*:*:* Versions 17.06.1-ce rc3 Vulnerable ·Docker
Show 54 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:17.06.1-ce:rc4:*:*:community:*:*:*17.06.1-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:17.06.2-ce:*:*:*:community:*:*:*17.06.2-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.06.2-ce:rc1:*:*:community:*:*:*17.06.2-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.07.0-ce:*:*:*:community:*:*:*17.07.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.07.0-ce:rc1:*:*:community:*:*:*17.07.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.07.0-ce:rc2:*:*:community:*:*:*17.07.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.07.0-ce:rc3:*:*:community:*:*:*17.07.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:17.07.0-ce:rc4:*:*:community:*:*:*17.07.0-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:17.09.0-ce:*:*:*:community:*:*:*17.09.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.09.0-ce:rc1:*:*:community:*:*:*17.09.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.09.0-ce:rc2:*:*:community:*:*:*17.09.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.09.0-ce:rc3:*:*:community:*:*:*17.09.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:17.09.1-ce:*:*:*:community:*:*:*17.09.1-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.09.1-ce-:rc1:*:*:community:*:*:*17.09.1-ce- rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.10.0-ce:*:*:*:community:*:*:*17.10.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.10.0-ce:rc1:*:*:community:*:*:*17.10.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.10.0-ce:rc2:*:*:community:*:*:*17.10.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.11.0-ce:*:*:*:community:*:*:*17.11.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.11.0-ce:rc1:*:*:community:*:*:*17.11.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.11.0-ce:rc2:*:*:community:*:*:*17.11.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.11.0-ce:rc3:*:*:community:*:*:*17.11.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:17.11.0-ce:rc4:*:*:community:*:*:*17.11.0-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:17.12.0-ce:*:*:*:community:*:*:*17.12.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.12.0-ce:rc1:*:*:community:*:*:*17.12.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.12.0-ce:rc2:*:*:community:*:*:*17.12.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:17.12.0-ce:rc3:*:*:community:*:*:*17.12.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:17.12.0-ce:rc4:*:*:community:*:*:*17.12.0-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:17.12.1-ce:*:*:*:community:*:*:*17.12.1-ceVulnerableDocker
cpe:2.3:a:docker:docker:17.12.1-ce:rc1:*:*:community:*:*:*17.12.1-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:17.12.1-ce:rc2:*:*:community:*:*:*17.12.1-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.01.0-ce:*:*:*:community:*:*:*18.01.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.01.0-ce:rc1:*:*:community:*:*:*18.01.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.02.0-ce:*:*:*:community:*:*:*18.02.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.02.0-ce:rc1:*:*:community:*:*:*18.02.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.02.0-ce:rc2:*:*:community:*:*:*18.02.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.03.0-ce:*:*:*:community:*:*:*18.03.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.03.0-ce:rc1:*:*:community:*:*:*18.03.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.03.0-ce:rc2:*:*:community:*:*:*18.03.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.03.0-ce:rc3:*:*:community:*:*:*18.03.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:18.03.0-ce:rc4:*:*:community:*:*:*18.03.0-ce rc4VulnerableDocker
cpe:2.3:a:docker:docker:18.03.1-ce:*:*:*:community:*:*:*18.03.1-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.03.1-ce:rc1:*:*:community:*:*:*18.03.1-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.03.1-ce:rc2:*:*:community:*:*:*18.03.1-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.04.0-ce:*:*:*:community:*:*:*18.04.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.04.0-ce:rc1:*:*:community:*:*:*18.04.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.04.0-ce:rc2:*:*:community:*:*:*18.04.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.05.0-ce:*:*:*:community:*:*:*18.05.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.05.0-ce:rc1:*:*:community:*:*:*18.05.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.06.0-ce:*:*:*:community:*:*:*18.06.0-ceVulnerableDocker
cpe:2.3:a:docker:docker:18.06.0-ce:rc1:*:*:community:*:*:*18.06.0-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.06.0-ce:rc2:*:*:community:*:*:*18.06.0-ce rc2VulnerableDocker
cpe:2.3:a:docker:docker:18.06.0-ce:rc3:*:*:community:*:*:*18.06.0-ce rc3VulnerableDocker
cpe:2.3:a:docker:docker:18.06.1-ce:rc1:*:*:community:*:*:*18.06.1-ce rc1VulnerableDocker
cpe:2.3:a:docker:docker:18.06.1-ce:rc2:*:*:community:*:*:*18.06.1-ce rc2VulnerableDocker
  • cpe:2.3:a:docker:docker:17.06.1-ce:rc4:*:*:community:*:*:* Versions 17.06.1-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.2-ce:*:*:*:community:*:*:* Versions 17.06.2-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.06.2-ce:rc1:*:*:community:*:*:* Versions 17.06.2-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.07.0-ce:*:*:*:community:*:*:* Versions 17.07.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.07.0-ce:rc1:*:*:community:*:*:* Versions 17.07.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.07.0-ce:rc2:*:*:community:*:*:* Versions 17.07.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.07.0-ce:rc3:*:*:community:*:*:* Versions 17.07.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.07.0-ce:rc4:*:*:community:*:*:* Versions 17.07.0-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.0-ce:*:*:*:community:*:*:* Versions 17.09.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.0-ce:rc1:*:*:community:*:*:* Versions 17.09.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.0-ce:rc2:*:*:community:*:*:* Versions 17.09.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.0-ce:rc3:*:*:community:*:*:* Versions 17.09.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.1-ce:*:*:*:community:*:*:* Versions 17.09.1-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.09.1-ce-:rc1:*:*:community:*:*:* Versions 17.09.1-ce- rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.10.0-ce:*:*:*:community:*:*:* Versions 17.10.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.10.0-ce:rc1:*:*:community:*:*:* Versions 17.10.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.10.0-ce:rc2:*:*:community:*:*:* Versions 17.10.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.11.0-ce:*:*:*:community:*:*:* Versions 17.11.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.11.0-ce:rc1:*:*:community:*:*:* Versions 17.11.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.11.0-ce:rc2:*:*:community:*:*:* Versions 17.11.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.11.0-ce:rc3:*:*:community:*:*:* Versions 17.11.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.11.0-ce:rc4:*:*:community:*:*:* Versions 17.11.0-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.0-ce:*:*:*:community:*:*:* Versions 17.12.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.0-ce:rc1:*:*:community:*:*:* Versions 17.12.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.0-ce:rc2:*:*:community:*:*:* Versions 17.12.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.0-ce:rc3:*:*:community:*:*:* Versions 17.12.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.0-ce:rc4:*:*:community:*:*:* Versions 17.12.0-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.1-ce:*:*:*:community:*:*:* Versions 17.12.1-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.1-ce:rc1:*:*:community:*:*:* Versions 17.12.1-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:17.12.1-ce:rc2:*:*:community:*:*:* Versions 17.12.1-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.01.0-ce:*:*:*:community:*:*:* Versions 18.01.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.01.0-ce:rc1:*:*:community:*:*:* Versions 18.01.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.02.0-ce:*:*:*:community:*:*:* Versions 18.02.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.02.0-ce:rc1:*:*:community:*:*:* Versions 18.02.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.02.0-ce:rc2:*:*:community:*:*:* Versions 18.02.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.0-ce:*:*:*:community:*:*:* Versions 18.03.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.0-ce:rc1:*:*:community:*:*:* Versions 18.03.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.0-ce:rc2:*:*:community:*:*:* Versions 18.03.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.0-ce:rc3:*:*:community:*:*:* Versions 18.03.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.0-ce:rc4:*:*:community:*:*:* Versions 18.03.0-ce rc4 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.1-ce:*:*:*:community:*:*:* Versions 18.03.1-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.1-ce:rc1:*:*:community:*:*:* Versions 18.03.1-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.03.1-ce:rc2:*:*:community:*:*:* Versions 18.03.1-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.04.0-ce:*:*:*:community:*:*:* Versions 18.04.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.04.0-ce:rc1:*:*:community:*:*:* Versions 18.04.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.04.0-ce:rc2:*:*:community:*:*:* Versions 18.04.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.05.0-ce:*:*:*:community:*:*:* Versions 18.05.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.05.0-ce:rc1:*:*:community:*:*:* Versions 18.05.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.0-ce:*:*:*:community:*:*:* Versions 18.06.0-ce Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.0-ce:rc1:*:*:community:*:*:* Versions 18.06.0-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.0-ce:rc2:*:*:community:*:*:* Versions 18.06.0-ce rc2 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.0-ce:rc3:*:*:community:*:*:* Versions 18.06.0-ce rc3 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.1-ce:rc1:*:*:community:*:*:* Versions 18.06.1-ce rc1 Vulnerable ·Docker
  • cpe:2.3:a:docker:docker:18.06.1-ce:rc2:*:*:community:*:*:* Versions 18.06.1-ce rc2 Vulnerable ·Docker

Remediation

Red Hat 1 advisory

  • RHSA-2019:1910 Released 2019-07-29 · Red Hat rating Moderate
    docker security and bug fix update
    • Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-102.git7f2769b.el7, docker-client-2:1.13.1-102.git7f2769b.el7, docker-common-2:1.13.1-102.git7f2769b.el7 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2019:1910
Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15664
  2. 2026-10-03 Alias added: GHSA-pv79-5r2c-jrpq

References

Exploit 2

Advisory 6

Other 2

  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2019-10626 In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code… CVSS 3.1CRITICAL 9.8
  • TI-2014-07591 Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a… CVSS 2.0HIGH 10.0
  • TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
  • TI-2014-07590 Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to… CVSS 3.1HIGH 8.6
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences