CVE-2014-8178 describes a vulnerability in Docker Engine versions prior to 1.8.3 and CS Docker Engine before 1.6.2-CS7, where the absence of globally unique identifiers for image layers allows attackers to poison the image cache through crafted images during pull or push operations. Rated Medium with a CVSS score of 5.5, this vulnerability requires user interaction (UI:R) and local access (AV:L) to achieve high integrity impact (I:H), but no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.2-cs7CPE matchmatch criteria | cpe:2.3:a:docker:cs_engine:*:*:*:*:*:*:*:* | ||
< 1.8.3CPE matchmatch criteria | cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* | ||
13.2CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2014-8178
Jul 13, 2021Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
Dec 10, 2019docker: Attacker controlled layer IDs lead to local graph content poisoning
Oct 13, 2015