TI-2014-06793 Aliases CVE-2014-8178 GHSA-cx5m-7cfp-6prc

Improper input validation in Docker Engine

LOW 25CWE-20Published 2019-12-04 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

Why it matters now

EPSS 0.00493 42nd percentileScored 2026-11-07

Fix Partial Docker Engine (Docker): 1.8.3CS Docker Engine (Docker): 1.6.2-CS7Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Docker	Docker Engine	before 1.8.3	1.8.3	Patch available	CNA
Docker	CS Docker Engine	before 1.6.2-CS7	1.6.2-CS7	Patch available	CNA

Docker Engine VendorDocker Affected before 1.8.3 Fixed in 1.8.3 Patch available CNA
CS Docker Engine VendorDocker Affected before 1.6.2-CS7 Fixed in 1.6.2-CS7 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:docker:cs_engine::::::::	before 1.6.2-cs7	Vulnerable	Docker
cpe:2.3:a:docker:docker::::::::	before 1.8.3	Vulnerable	Docker
cpe:2.3:o:opensuse:opensuse:13.2:::::::*	13.2	Vulnerable	openSUSE

cpe:2.3:a:docker:cs_engine:*:*:*:*:*:*:*:* Versions before 1.6.2-cs7 Vulnerable ·Docker
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* Versions before 1.8.3 Vulnerable ·Docker
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE

Remediation

Fix · CNA Docker Engine (Docker) Fixed in 1.8.3
Fix · CNA CS Docker Engine (Docker) Fixed in 1.6.2-CS7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2014-8178
2026-10-03 Alias added: GHSA-cx5m-7cfp-6prc

References

Patch 1

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html

Advisory 3

Other 1

https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ

TI-2014-06794 Improper input validation in Docker Engine CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences