CVE-2014-8178

Published: Dec 17, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

Affected (3)

Products: Docker: Cs Engine, Docker · Opensuse: Opensuse

2 products

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Docker Cs Engine	Before 1.6.2-cs7
Docker Docker	Before 1.8.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html

Source: secalert@redhat.com

Third Party Advisory

https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12

Source: secalert@redhat.com

Third Party Advisory

https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ

Source: secalert@redhat.com

https://www.docker.com/legal/docker-cve-database

Source: secalert@redhat.com

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html