Command injection in docker-tester
Date: 2022-06
Affected: npm/docker-tester
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2021-34079
CWE: CWE-74

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.


Mitigations:

Architectural layers (MAESTRO):