CVE-2014-8178 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a craf...
MediumCVSS 5.5
EPSS 0.49%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/docker.io(Debian:12) | < 1.8.3~ds1-1 | 1.8.3~ds1-1 |
| debian/docker.io(Debian:13) | < 1.8.3~ds1-1 | 1.8.3~ds1-1 |
| debian/docker.io(Debian:14) | < 1.8.3~ds1-1 | 1.8.3~ds1-1 |
| docker cs engine | < 1.6.2-cs7 | 1.6.2-cs7 |
| docker github.com/docker/docker | < 1.8.3 | 1.8.3 |
| opensuse | = 13.2 | No fix listed |
| Docker Engine | = before 1.8.3 | No fix listed |
| docker CS Docker Engine | = before 1.6.2-CS7 | No fix listed |
References
- Debian Security Tracker CVE-2014-8178 vendor-advisory
- lists.opensuse.org patch third-party-advisory
- lists.opensuse.org third-party-advisory
- github.com third-party-advisory
- groups.google.com
- www.docker.com vendor-advisory