PT-2014-7211 · Docker+1 · Docker+1

Published 2014-12-08 · Updated 2025-10-11 · CVE-2014-6408

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Docker versions 1.3.0 through 1.3.1

Description The issue allows remote attackers to modify the default run profile of image containers. This could possibly lead to bypassing the container by applying unspecified security options to an image.

Recommendations For Docker versions 1.3.0 through 1.3.1, consider restricting access to the default run profile of image containers until a fix is available. As a temporary workaround, review and limit the application of security options to images to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-264

Related Identifiers

CVE-2014-6408

GHSA-44GG-PMQR-4669

GO-2022-0625

OPENSUSE-SU-2014_1596-1

OPENSUSE-SU-2024:10532-1

OPENSUSE-SU-2025:15589-1

SUSE-SU-2025:03540-1

SUSE-SU-2025:03545-1

Affected Products

Docker

Suse

References · 270

• https://osv.dev/vulnerability/openSUSE-SU-2024:10532-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44gg-pmqr-4669 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03545-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15589-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-6408 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03540-1 · Vendor Advisory
• https://docs.docker.com/v1.3/release-notes · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0625 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-6408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6408 · Security Note
• https://linux.oracle.com/errata/ELSA-2014-3095.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-6408 · Vendor Advisory