PT-2019-7142 · Docker+1 · Docker Engine+2

Publicado

2015-10-14

·

Atualizado

2025-10-11

·

CVE-2014-8179

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 1.8.3 CS Docker Engine versions prior to 1.6.2-CS7
Description The issue arises from improper validation and extraction of the manifest object from its JSON representation during a pull. This allows attackers to inject new attributes in a JSON object, effectively bypassing pull-by-digest validation.
Recommendations For Docker Engine versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. For CS Docker Engine versions prior to 1.6.2-CS7, update to version 1.6.2-CS7 or later to resolve the issue.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-8179
MGASA-2016-0043
OPENSUSE-SU-2024:10532-1
OPENSUSE-SU-2025:15589-1
SUSE-SU-2015:1757-1
SUSE-SU-2025:03540-1
SUSE-SU-2025:03545-1

Produtos afetados

Docker
Docker Engine
Suse