PT-2017-13809 · Docker+1 · Docker Ce+2

N4Ss · Published 2017-11-01 · Updated 2025-10-11 · CVE-2017-14992

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Docker-CE (Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier

Description The issue is related to a lack of content verification, allowing a remote attacker to cause a Denial of Service via a crafted image layer payload, also known as gzip bombing.

Recommendations For Docker-CE (Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-20

CWE-770

Related Identifiers

CVE-2017-14992

GHSA-HQWH-8XV9-42HW

GO-2025-3640

MGASA-2018-0398

OPENSUSE-SU-2018_0406-1

OPENSUSE-SU-2024:10722-1

OPENSUSE-SU-2024:11385-1

OPENSUSE-SU-2025:15033-1

OPENSUSE-SU-2025:15589-1

SUSE-SU-2018:0386-1

SUSE-SU-2018_0386-1

SUSE-SU-2025:03540-1

SUSE-SU-2025:03545-1

Affected Products

Docker

Docker Ce

Suse

References · 284

• https://osv.dev/vulnerability/MGASA-2018-0398 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03545-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15589-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14992 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11385-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14992 · Security Note
• https://ubuntu.com/security/CVE-2017-14992 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/LA2D3UDMXW44UEZC4BRH5EKHBGQNP2UC · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03540-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-14992 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3640 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15033-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10722-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0398.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14992 · Vendor Advisory