UpHeron
All vulnerabilities

Servers and applications

CVE-2019-13509

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

Severity
High 7.5
Published
18 Jul 2019
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
18.09.8
Sources
NVD

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:docker:docker
  • From 18.09.0 before 18.09.8
  • Version 18.03.1-9
  • Version 18.03.1-8
  • Version 18.03.1-7
All 40 release lines
  • Every version before 18.09.8
  • Version 17.03.2-1
  • Version 17.03.2-2
  • Version 17.03.2-3
  • Version 17.03.2-4
  • Version 17.03.2-5
  • Version 17.03.2-6
  • Version 17.03.2-7
  • Version 17.03.2-8
  • Version 17.06.2-1
  • Version 17.06.2-2
  • Version 17.06.2-3
  • Version 17.06.2-4
  • Version 17.06.2-5
  • Version 17.06.2-6
  • Version 17.06.2-7
  • Version 17.06.2-8
  • Version 17.06.2-9
  • Version 17.06.2-10
  • Version 17.06.2-11
  • Version 17.06.2-12
  • Version 17.06.2-13
  • Version 17.06.2-15
  • Version 17.06.2-16
  • Version 17.06.2-17
  • Version 17.06.2-18
  • Version 17.06.2-19
  • Version 17.06.2-20
  • Version 17.06.2-21
  • Version 17.06.2-22
  • Version 18.03.1-1
  • Version 18.03.1-2
  • Version 18.03.1-3
  • Version 18.03.1-4
  • Version 18.03.1-5
  • Version 18.03.1-6
  • Version 18.03.1-7
  • Version 18.03.1-8
  • Version 18.03.1-9
  • From 18.09.0 before 18.09.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-13509
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-13509