Non notée
CVE-2014-8179 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest…
Description
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Docker Engine | Versions non publiées | |
| CS Docker Engine | Versions non publiées |
Références
- lists.opensuse.org lists.opensuse.org
- lists.opensuse.org lists.opensuse.org
- groups.google.com groups.google.com
- github.com github.com
- blog.docker.com blog.docker.com
- www.docker.com www.docker.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Docker Engine
Les 5 CVE de Docker Engine →
CVE-2026-92543
Docker Engine classifies a registry hostname as insecure using an any-match DNS check
7.6
Élevée
CVE-2026-92542
The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams…
6.9
Moyenne
CVE-2026-17106
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
7.1
Élevée
CVE-2014-8178
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store…
Non notée