Docker image layers are stored with a non-globally unique identifier vulnerable to a collision attack. These identifiers are shared during docker pull and push, allowing poisoning of a host's image cache. This allows maliciously crafted images to poison subsequently pulled images.
Independently discovered by Florian Weimer of Red Hat and Tõnis Tiigi of the Docker Engine Tem.
This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content.
Marking this vulnerability and its children as "WONTFIX".
Statement:
This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content.