Not rated
CVE-2014-8179 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest…
Description
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Docker Engine | Versions not published | |
| CS Docker Engine | Versions not published |
References
- lists.opensuse.org lists.opensuse.org
- lists.opensuse.org lists.opensuse.org
- groups.google.com groups.google.com
- github.com github.com
- blog.docker.com blog.docker.com
- www.docker.com www.docker.com
Timeline
- Published
- Last modified
Other CVEs of Docker Engine
The 5 CVEs of Docker Engine →
CVE-2026-92543
Docker Engine classifies a registry hostname as insecure using an any-match DNS check
7.6
High
CVE-2026-92542
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams…
6.9
Medium
CVE-2026-17106
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
7.1
High
CVE-2014-8178
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store…
Not rated