NVD Vulnerability Detail

CVE-2014-8178

Summary	Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
Publication Date	Dec. 17, 2019, 11:15 p.m.
Registration Date	Jan. 26, 2021, 3:20 p.m.
Last Update	Nov. 21, 2024, 11:18 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	Patch Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	Patch Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	Third Party Advisory
5	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	Third Party Advisory
6	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	Third Party Advisory
7	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
8	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
9	https://www.docker.com/legal/docker-cve-database	Vendor Advisory
10	https://www.docker.com/legal/docker-cve-database	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Docker Engine および CS Docker Engine における入力確認に関する脆弱性

Title	Docker Engine および CS Docker Engine における入力確認に関する脆弱性
Summary	Docker Engine および CS Docker Engine には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 10, 2014, midnight
Registration Date	Jan. 16, 2020, 2:44 p.m.
Last Update	Jan. 16, 2020, 2:44 p.m.

Affected System

openSUSE project

openSUSE

Docker

CS Docker Engine 1.6.2-CS7 未満

Docker 1.8.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-8178	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8178
National Vulnerability Database (NVD)
2	CVE-2014-8178	https://nvd.nist.gov/vuln/detail/CVE-2014-8178

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Docker
1	Docker CVE Database	https://www.docker.com/legal/docker-cve-database
GitHub
2	Changelog	https://github.com/moby/moby/blob/master/CHANGELOG.md#183-2015-10-12
opensuse-security-announce
3	openSUSE-SU-2015:1773-1: moderate: Security update for docker	https://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html
4	[security-announce] SUSE-SU-2015:1757-1: important: Security update for docker	https://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html

Change Log

No	Changed Details	Date of change
1	[2020年01月16日] 掲載	Jan. 16, 2020, 2:44 p.m.