CVE-2014-5282: Input Validation
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
Other sources
From the upstream report [1]:
================================================================ [CVE-2014-5282] Tagging image to ID can redirect images on subsequent pulls ==============================================================
Importance: Medium Affects: Docker 1.2 and lower Description:
It has been discovered that users of the Docker Remote API and CLI could cause one image repository, upon pull, to redirect to the content of another image. This is vulnerability affects all versions of Docker up to, but excluding version 1.3.
The primary vector for an attack is by loading of untrusted images via ‘docker load’. Images downloaded from DockerHub or private registries cannot exploit this vulnerability.
It is recommended that users upgrade to Docker engine 1.3.
Users of older releases of docker are advised not to load untrusted images via ‘docker load’. Vendors supporting older releases of Docker should assure they do not allow untrusted tenants to provide images for import with ‘docker load’, or tag images to arbitrary names equal to 64-characters containing characters within the range of [0-9a-f].
Discovered by Eric Windisch of Docker, Inc.
[1] https://groups.google.com/forum/#!msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5282?
CVE-2014-5282 is classified as a medium severity vulnerability allowing potential redirection of images.
How do I fix CVE-2014-5282?
To remediate CVE-2014-5282, upgrade Docker to version 1.3 or later.
What versions are affected by CVE-2014-5282?
CVE-2014-5282 affects all Docker versions prior to 1.3.
What type of attack is associated with CVE-2014-5282?
CVE-2014-5282 allows attackers to load untrusted images and redirect to another image.
Can CVE-2014-5282 be exploited remotely?
Yes, CVE-2014-5282 can be exploited by remote attackers through the loading of untrusted images.