CVE-2020-27534

Medium

Advisory

Published 31 Jan 2024In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.017; 77th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 109; of 17,781 indexed, latest versions
Container images: 102; deployed by those charts
Fix available: 2 of 2; affected packages

Path Traversal in Moby builder

Carried by container images the latest versions of 109 of 17,781 indexed charts deploy, on 102 images.

Affected package	Affected versions	Fixed in	Images
github.com/docker/dockergolang	v0.0.0-20180620051407-e2593239d949, v0.7.3-0.20190327010347-be7ac8be2ae0, v1.4.2-0.20190924003213-a8608b5b67c7, v1.4.2-0.20191121165722-d1d5f6476656+10 more	19.03.9	90
github.com/moby/mobygolang	v0.7.3-0.20190826074503-38ab9da00309, v1.4.2-0.20170731201646-1009e6a40b29, v1.13.1, v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	19.03.9	17

OSV records: GHSA-6hwg-w5jg-9c6x

Charts affected

109 by stars

Chart

Latest

Affected images

Radar Score

minio-operatorstatcan

4.1.0

1 of 2 See more

minio-operator statcan 4.1.0

1 of the 2 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
minio/operator :v4.1.0	2adc5be088f5	github.com/docker/docker@v1.4.2-0.20190924003213-a8608b5b67c7	19.03.9

Open the chart page →

6,596

taalhuizen-servicetaalhuizen-service

1.0.0

1 of 3 See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,480

trouw-servicetrouw-service

1.0.0

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,510

verhuis-serviceverhuis-service

1.0.0

1 of 3 See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,510

verzoekconversieserviceverzoekconversieservice

1.0.0

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,528

verzoekregistratiecomponentverzoekregistratiecomponent

1.1.0

1 of 4 See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,429

verzoektypecatalogusverzoektypecatalogus

1.1.0

1 of 4 See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,429

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	github.com/docker/docker@v1.4.2-0.20200203170920-46ec8731fbce	19.03.9

Open the chart page →

7,552

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2020-27534.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	github.com/docker/docker@v1.13.1	19.03.9

Open the chart page →

2,745

Container images carrying it

102 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/docker/docker@v1.4.2-0.20200319182547-c7ad2b866182 github.com/moby/moby@v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible	19.03.9 19.03.9	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	github.com/docker/docker@v17.12.1-ce+incompatible	19.03.9	1