Към съдържанието
Търсене

CVE-2025-15558: Docker CLI, верига на доставки

7.3

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и след действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/[email protected]+incompatible/cli-plugins/manager  package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.

Засегнати продукти

  • Docker Docker CLI: 29.2.0
  • Docker Compose: 5.1.0
  • Red Hat: още 27 продукта, добавени от Red Hat

    Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Gatekeeper 3, Kernel Module Management Operator for Red Hat Openshift, Machine Deletion Remediation Operator, Multicluster Engine for Kubernetes, Multicluster Global Hub, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift for Windows Containers, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Trusted Artifact Signer, Security Profiles Operator, Zero Trust Workload Identity Manager, Zero Trust Workload Identity Manager - Tech Preview

Вид слабост

История

  • 4 март 2026 Публикувано

Други уязвимости в Docker Docker CLI

Първоизточници

CVE-2025-15558: Docker CLI, верига на доставки | freedomonline.bg