Critical severity · published Jan 2, 2020
CVE-2014-0048
An issue was found in Docker before 1.6.0
9.8
CVSS
7.3%
EPSS
No
On KEV
Description
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Docker · Docker
before 1.5.0 · source: NVD
GE
Geode · Apache
1.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0048
Mailing List
http://www.openwall.com/lists/oss-security/2015/03/24/18
Mailing List
http://www.openwall.com/lists/oss-security/2015/03/24/22
Mailing List
http://www.openwall.com/lists/oss-security/2015/03/24/23
Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-0048
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0048
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0048
More from Geode
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
7.8
CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
9.8
CVE-2022-37021
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2017-15692
In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data