Fluid Attacks Database

Description

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	docker.io	>=0 <1.8.3~ds1-1	1.8.3~ds1-1
debian 11	docker.io	>=0 <1.8.3~ds1-1	1.8.3~ds1-1
debian 14	docker.io	>=0 <1.8.3~ds1-1	1.8.3~ds1-1
debian 12	docker.io	>=0 <1.8.3~ds1-1	1.8.3~ds1-1
rpm rhel7	docker	-	-

Aliases

1. CVE-2014-81782. NVD-2014-81783. OSV-DEBIAN-2014-81784. OSV-2014-81785. SECURITY-TRACKER-CVE-2014-8178

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.