NVD Vulnerability Detail

CVE-2014-8179

Summary	Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Publication Date	Dec. 18, 2019, 3:15 a.m.
Registration Date	Jan. 26, 2021, 3:20 p.m.
Last Update	Nov. 21, 2024, 11:18 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html	Third Party Advisory
5	https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/	Not Applicable Vendor Advisory
6	https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/	Not Applicable Vendor Advisory
7	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	Third Party Advisory
8	https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12	Third Party Advisory
9	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
10	https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
11	https://www.docker.com/legal/docker-cve-database	Vendor Advisory
12	https://www.docker.com/legal/docker-cve-database	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Docker Engine および CS Docker Engine における入力確認に関する脆弱性

Title	Docker Engine および CS Docker Engine における入力確認に関する脆弱性
Summary	Docker Engine および CS Docker Engine には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 10, 2014, midnight
Registration Date	Dec. 26, 2019, 5:47 p.m.
Last Update	Dec. 26, 2019, 5:47 p.m.

Affected System

openSUSE project

openSUSE

Docker

CS Docker Engine 1.6.2-CS7 未満

Docker 1.8.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-8179	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8179
National Vulnerability Database (NVD)
2	CVE-2014-8179	https://nvd.nist.gov/vuln/detail/CVE-2014-8179

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Docker
1	Docker CVE Database	https://www.docker.com/legal/docker-cve-database
GitHub
2	Changelog (1.8.3 (2015-10-12))	https://github.com/moby/moby/blob/master/CHANGELOG.md#183-2015-10-12
openSUSE Security Update
3	openSUSE-SU-2015:1773	https://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html
opensuse-security-announce
4	SUSE-SU-2015:1757	http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html

Change Log

No	Changed Details	Date of change
1	[2019年12月26日] 掲載	Dec. 26, 2019, 5:47 p.m.