CVE-2017-14992 tar-split memory exhaustion

What is CVE-2017-14992?

CVE-2017-14992 is a medium-severity denial of service vulnerability in n/a, published on 1 Nov 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.

Weakness: CWE-20

Which versions are affected by CVE-2017-14992?

3 open source packages ship an affected version, including github.com/vbatts/tar-split. It affects 1 product.

Products include Docker Docker.

How do I fix CVE-2017-14992?

Upgrade github.com/vbatts/tar-split to 0.10.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-14992 being exploited?

There is no known exploitation of CVE-2017-14992 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-9357 Arbitrary Code Execution Critical 10.0
• CVE-2020-14298 Privilege escalation in Docker High 8.8
• CVE-2020-14300 Privilege escalation in Docker High 8.8
• CVE-2018-15514 Deserialization in n/a High 8.8
• CVE-2014-9356 Path Traversal in Docker High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-14992, GHSA-hqwh-8xv9-42hw, GO-2025-3640, UBUNTU-CVE-2017-14992.