{"id":"CVE-2019-1020014","aliases":["DEBIAN-CVE-2019-1020014","EUVD-2019-2060","GHSA-h8cp-ph26-xwmv","MGASA-2019-0269","UBUNTU-CVE-2019-1020014","USN-4103-2","USN-4856-1"],"status":"published","title":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00406,"percentile":0.35329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2019-07-29T00:00:00Z","modified":"2026-10-20T10:50:36Z","fixes":[{"ecosystem":"Debian:12","package":"golang-github-docker-docker-credential-helpers","fixed_in":["0.6.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-docker-docker-credential-helpers","fixed_in":["0.6.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-docker-docker-credential-helpers","fixed_in":["0.6.1-3"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"docker","fixed_in":["18.06.3-1.2.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"docker","fixed_in":["18.09.8-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"docker.io","fixed_in":["18.09.7-0ubuntu1~16.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"docker.io","fixed_in":["18.09.7-0ubuntu1~18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-github-docker-docker-credential-helpers","fixed_in":["0.5.0-2ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"golang-github-docker-docker-credential-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-docker-docker-credential-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-docker-docker-credential-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-3"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.06.3-1.2.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.8-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~16.04.5"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~18.04.4"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-github-docker-docker-credential-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-2ubuntu0.1+esm1"}]}],"versions":["0.5.0-2","0.5.0-2ubuntu0.1~esm1","0.5.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~16.04.5"}]}],"versions":["1.6.2~dfsg1-1ubuntu4","1.10.2-0ubuntu3","1.10.2-0ubuntu4","1.10.3-0ubuntu1","1.10.3-0ubuntu4","1.10.3-0ubuntu5","1.10.3-0ubuntu6","1.11.2-0ubuntu5~16.04","1.12.1-0ubuntu13~16.04.1","1.12.3-0ubuntu4~16.04.2","1.12.6-0ubuntu1~16.04.1","1.13.1-0ubuntu1~16.04.2","17.03.2-0ubuntu2~16.04.1","18.06.1-0ubuntu1~16.04.2","18.06.1-0ubuntu1.2~16.04.1","18.09.2-0ubuntu1~16.04.1","18.09.5-0ubuntu1~16.04.2","18.09.7-0ubuntu1~16.04.1","18.09.7-0ubuntu1~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"docker.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.09.7-0ubuntu1~18.04.4"}]}],"versions":["1.13.1-0ubuntu6","17.03.2-0ubuntu1","17.03.2-0ubuntu3","17.03.2-0ubuntu5","17.12.1-0ubuntu1","18.06.1-0ubuntu1~18.04.1","18.06.1-0ubuntu1.2~18.04.1","18.09.2-0ubuntu1~18.04.1","18.09.5-0ubuntu1~18.04.2","18.09.7-0ubuntu1~18.04.1","18.09.7-0ubuntu1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-github-docker-docker-credential-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-2ubuntu0.1+esm1"}]}],"versions":["0.5.0-2","0.5.0-2ubuntu0.1~esm1","0.5.0-2ubuntu0.1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"docker","product":"credential_helpers"},{"vendor":"docker","product":"docker-credential-helpers"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/docker/docker-credential-helpers/commit/1c9f7ede70a5ab9851f4c9cb37d317fd89cd318a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/docker/docker-credential-helpers/releases/tag/v0.6.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://usn.ubuntu.com/4103-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4103-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VVFB6UWUK2GQQN7DVUU6GRRAL637A73/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1020014"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6VVFB6UWUK2GQQN7DVUU6GRRAL637A73/"},{"url":"https://github.com/advisories/GHSA-h8cp-ph26-xwmv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-1020014","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0269.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1020014","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4103-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4103-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4856-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1020014","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-1020014","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T12:20:21Z","modified":"2024-08-05T03:14:16.187Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-2060","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T12:20:21Z","modified":"2024-08-05T03:14:16Z","updated_at":"2026-11-03T02:40:18.31448Z"}],"ghsa":[{"id":"GHSA-h8cp-ph26-xwmv","title":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2022-05-24T16:51:37Z","modified":"2023-01-27T05:07:27Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:43:07.326529Z"}],"nvd":[{"id":"CVE-2019-1020014","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T13:15:11.997Z","modified":"2026-06-17T02:10:00.933Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-1020014","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T13:15:11.997Z","modified":"2026-10-20T10:50:36.832246958Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-1020014","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T13:15:11.997Z","modified":"2026-09-21T07:00:50.962222456Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2019-1020014","description":"docker-credential-helpers before 0.6.3 has a double free in the List functions.","status":"published","published":"2019-07-29T00:00:00Z","modified":"2026-02-04T02:33:41.533981Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"MGASA-2019-0269","title":"Updated docker packages fix security vulnerability","description":"Updated docker packages fix security vulnerability:\n\nJasiel Spelman discovered that a double free existed in the \ndocker-credential-helpers bundled in Docker. A local attacker could use\nthis to cause a denial of service (crash) or possibly execute arbitrary\ncode (CVE-2019-1020014).\n","status":"published","published":"2019-09-12T19:09:52Z","modified":"2026-04-16T04:43:46.246532236Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"USN-4103-2","title":"Docker vulnerability","description":"Jasiel Spelman discovered that a double free existed in the docker-credential-\nhelpers dependency of Docker. A local attacker could use this to cause a denial of service\n(crash) or possibly execute arbitrary code.\n\nOriginal advisory details:\n\n Jasiel Spelman discovered that a double free existed in docker-credential-\n helpers. A local attacker could use this to cause a denial of service\n (crash) or possibly execute arbitrary code.\n","status":"published","published":"2019-08-19T17:09:45Z","modified":"2026-02-10T04:41:36Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4856-1","title":"golang-github-docker-docker-credential-helpers vulnerability","description":"Jasiel Spelman discovered that docker-credential-helpers has a double free. A\nlocal attacker could use this to cause a denial of service (crash) or possibly\nexecute arbitrary code.\n","status":"published","published":"2021-03-15T22:42:37Z","modified":"2026-02-10T04:42:06Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}