Docker Inc. has reported that it is possible to spoof images on the central registry. From the report:
"It has been discovered that Docker does not sufficiently validate Image IDs as provided either via 'docker load' or through registry communications. This allows for path traversal attacks, causing graph corruption and manipulation by malicious images, as well as repository spoofing attacks."
Created docker-io tracking bugs for this issue:
Affects: fedora-all [bug 1173324]
Affects: epel-6 [bug 1173325]
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Extras
Via RHSA-2014:1947 https://rhn.redhat.com/errata/RHBA-2014-1977.html
Red Hat would like to thank Docker Inc. for reporting this issue.
docker-io-1.4.0-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
docker-io-1.4.1-6.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.