CVE-2014-8178

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

Score

CVSS 3.1 5.5 Medium

Status

Modified - secalert@redhat.com

Published

2019-12-17

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Cs Docker Engine (Docker)
• Cs Engine (Docker)
• Docker (Docker)
• Docker Engine (Docker)
• Opensuse (Opensuse)

References

• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html
• https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12
• https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
• https://www.docker.com/legal/docker-cve-database