CVE-2014-8179

2019-12-0415:10:35

redhat

www.cve.org

0.002 Low

EPSS

Percentile

56.2%

JSON

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

CNA Affected

[
  {
    "product": "Docker Engine",
    "vendor": "Docker",
    "versions": [
      {
        "status": "affected",
        "version": "before 1.8.3"
      }
    ]
  },
  {
    "product": "CS Docker Engine",
    "vendor": "Docker",
    "versions": [
      {
        "status": "affected",
        "version": "before 1.6.2-CS7"
      }
    ]
  }
]