CVE-2014-8179 Other in CS Docker Engine
Attackers can bypass pull-by-digest validation in Docker Engine by injecting attributes into JSON manifests, compromising image integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8179?
CVE-2014-8179 is a high-severity vulnerability in Opensuse Opensuse, published on 4 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Weakness: CWE-20
Which versions are affected by CVE-2014-8179?
It affects 3 products.
Products include Docker Cs Engine, Docker Docker, Opensuse Opensuse.
How do I fix CVE-2014-8179?
Upgrade to a fixed version.
Is CVE-2014-8179 being exploited?
There is no known exploitation of CVE-2014-8179 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2014-8179, GHSA-7w47-v4xv-5crg, UBUNTU-CVE-2014-8179.