CVE-2014-8179: Input Validation
First published: Tue Dec 17 2019(Updated: )
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker Cs Engine | <1.6.2-cs7 | |
| Docker Docker | <1.8.3 | |
| Oracle Java Runtime Environment (JRE) | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html
- https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/
- https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12
- https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
- https://www.docker.com/legal/docker-cve-database
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
This vulnerability is identified by CVE-2014-8179.
What is the severity of CVE-2014-8179?
The severity of CVE-2014-8179 is high with a severity value of 7.5.
What is the affected software by CVE-2014-8179?
The affected software includes Docker Engine versions before 1.8.3 and CS Docker Engine versions before 1.6.2-CS7.
How can this vulnerability be exploited?
This vulnerability allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation during a Docker pull operation.
Are there any references related to CVE-2014-8179?
Yes, you can find references to CVE-2014-8179 at the following links: [link1](http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html), [link2](http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html), [link3](https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/).
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/docker
- canonical/docker cs engine
- canonical/docker docker
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/13.2