CVE-2014-8179: falha em Docker Engine
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.7%
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
CVEs relacionadas — Docker Engine
No mesmo produto, das mais perigosas para as menos.
CVE-2014-8178—CVE-2014-8178EPSS 0.5%CVE-2026-17106HIGHTar extraction in moby/go-archive can write outside the destination directory via link followingEPSS 0.4%CVE-2026-92543HIGHDocker Engine insecure-registry fallback via malicious DNS responsesEPSS 0.1%CVE-2026-92542MEDIUMBlind VXLAN injection into encrypted overlay networks from cluster peerEPSS 0.1%
Referências
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.htmlhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00036.htmlhttps://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJhttps://www.docker.com/legal/docker-cve-database