轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊TACERT-ANA-2025110405112828

[內容說明]
Docker Compose是用於定義與管理多個容器的應用工具，能簡化部署流程並提高開發效率。Docker發布重大資安漏洞更新公告(CVE-2025-62725，CVSS 4.x：8.9)並釋出更新版本，此為路徑遍歷漏洞，允許攻擊者繞過Compose的快取目錄，進而在主機上覆寫任意檔案。

[影響平台]
Docker Compose v2.40.2(不含)之前版本

[建議措施]
更新 Docker Compose v2.40.2(含)之後版本

[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-10485-6b5b2-1.html
Forwarded from Taiwan Computer Network Crisis Management and Coordination Center (TACERT-ANA-2025110405112828)

[Content Description]
Docker Compose is an application tool used to define and manage multiple containers, simplifying deployment processes and improving development efficiency. Docker has released a critical security vulnerability update (CVE-2025-62725, CVSS 4.x: 8.9) and an updated version. This is a path traversal vulnerability that allows attackers to bypass Compose's cache directory and overwrite arbitrary files on the host machine.

[Affected Platforms]
Docker Compose versions prior to v2.40.2 (excluding v2.40.2)

[Recommended Actions]
Update to Docker Compose version v2.40.2 or later

[References]
1. https://www.twcert.org.tw/tw/cp-169-10485-6b5b2-1.html