tar-split memory exhaustion

MEDIO 6.5CVE-2017-14992 · GHSA-hqwh-8xv9-42hw · GO-2025-3640 · Published 01/11/2017 · updated 17/06/2026

In breve

CVE-2017-14992 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda github.com/vbatts/tar-split, docker (docker).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.4% delle vulnerabilità.
Correzione: aggiornare a 0.10.2 o successiva.

Package	Affected versions	Patched versions
github.com/vbatts/tar-split Go	`< 0.10.2`	`0.10.2`
docker docker	`= 1.12.6-0= 17.03.0= 17.03.1= 17.03.2= 17.06.0= 17.06.1= 17.06.2= 17.09.0≤ 1.10.3`	No fix yet

Description

Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-14992 · ADVISORY
moby/moby · WEB
vbatts/tar-split#42 · WEB
vbatts/tar-split · PACKAGE
vbatts/tar-split release v0.10.2 · WEB
web.archive.org/web/20171119174639/https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992 · WEB
blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992 · Third Party Advisory
GitHub Advisory GHSA-hqwh-8xv9-42hw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/vbatts/tar-split

< 0.10.2

0.10.2

docker

= 1.12.6-0= 17.03.0= 17.03.1= 17.03.2= 17.06.0= 17.06.1= 17.06.2= 17.09.0≤ 1.10.3

No fix yet

Description

NVD description