CVE-2019-13509

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

• CWE-532

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
• http://www.securityfocus.com/bid/109253Third Party Advisory, VDB Entry
• https://docs.docker.com/engine/release-notes/Release Notes, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/
• https://seclists.org/bugtraq/2019/Sep/21
• https://security.netapp.com/advisory/ntap-20190828-0003/
• https://www.debian.org/security/2019/dsa-4521
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
• http://www.securityfocus.com/bid/109253Third Party Advisory, VDB Entry
• https://docs.docker.com/engine/release-notes/Release Notes, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N674WD3OBDPHLWY6EABRHQH5ON6SUJBU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFFBVE7O73TAVY2BCWXSA2OOSLJVCPXC/
• https://seclists.org/bugtraq/2019/Sep/21
• https://security.netapp.com/advisory/ntap-20190828-0003/
• https://www.debian.org/security/2019/dsa-4521

Published

Jul 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13503mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-base…7.5
• CVE-2019-13504There is an out-of-bounds read in Exiv2::MrwImage::readMetad…6.5
• CVE-2019-13505The Appointment Hour Booking plugin 1.1.44 for WordPress all…6.1
• CVE-2019-13506@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2,…
• CVE-2019-13507hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
• CVE-2019-13508FreeTDS through 1.1.11 has a Buffer Overflow.9.8
• CVE-2019-1351A tampering vulnerability exists when Git for Visual Studio …7.5
• CVE-2019-13510Rockwell Automation Arena Simulation Software versions 16.00…
• CVE-2019-13511Rockwell Automation Arena Simulation Software versions 16.00…3.3
• CVE-2019-13512Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable …3.3
• CVE-2019-13513In Delta Industrial Automation DOPSoft, Version 4.00.06.15 a…7.8
• CVE-2019-13514In Delta Industrial Automation DOPSoft, Version 4.00.06.15 a…7.8