Read the docs
TI-2020-11169 Aliases CVE-2020-14298GHSA-vqjv-866h-qv94

The version of docker as released for Red Hat Enterprise Linux 7 Extras via…

Priority LOW 38CWE-273Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.

Why it matters now

EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—DockerAffected version is 1.13.1-108.git4ef4b30.el7 shipped in Red Hat Enterprise Linux 7 Extras—No fix listedCNA
  • Docker Vendor— Affected Affected version is 1.13.1-108.git4ef4b30.el7 shipped in Red Hat Enterprise Linux 7 Extras Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:1.13.1:*:*:*:*:*:*:*1.13.1VulnerableDocker
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*3.0 – 3.7.61VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:docker:docker:1.13.1:*:*:*:*:*:*:* Versions 1.13.1 Vulnerable ·Docker
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* Versions 3.0 – 3.7.61 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2020:2653 Released 2020-06-23 · Red Hat rating Important
    docker security update
    • Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-162.git64e9980.el7_8, docker-client-2:1.13.1-162.git64e9980.el7_8, docker-common-2:1.13.1-162.git64e9980.el7_8 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2020:2653

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14298
  2. 2026-10-03 Alias added: GHSA-vqjv-866h-qv94

References

Patch 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences