| Summary: | CVE-2014-8178 docker: Attacker controlled layer IDs lead to local graph content poisoning | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Trevor Jay <tjay> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | adimania, admiller, bleanhar, ccoleman, dwalsh, golang-updates, hushan.jia, ichavero, jchaloup, jperrin, lsm5, mgoldman, miminar, s, thrcka, vbatts, wolfy |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-10-13 14:01:37 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 1271259, 1271260, 1271261 | ||
| Bug Blocks: | |||
|
Description
Trevor Jay
2015-10-13 13:38:13 UTC
Created docker-io tracking bugs for this issue: Affects: fedora-all [bug 1271261] This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content. Marking this vulnerability and its children as "WONTFIX". We will get the fix from docker when we release docker-1.9. Statement: This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content. Fixed in 1.8.3 and greater. |