CVE-2014-8179

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.htmlThird Party Advisory
• https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/Not Applicable, Vendor Advisory
• https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12Third Party Advisory
• https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
• https://www.docker.com/legal/docker-cve-databaseVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.htmlThird Party Advisory
• https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/Not Applicable, Vendor Advisory
• https://github.com/docker/docker/blob/master/CHANGELOG.md#183-2015-10-12Third Party Advisory
• https://groups.google.com/forum/#%21msg/docker-dev/bWVVtLNbFy8/UaefOqMOCAAJ
• https://www.docker.com/legal/docker-cve-databaseVendor Advisory

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8173The pmd_none_or_trans_huge_or_clear_bad function in include/…
• CVE-2014-8174eDeploy makes it easier for remote attackers to execute arbi…
• CVE-2014-8175Red Hat JBoss Fuse before 6.2.0 allows remote authenticated …
• CVE-2014-8176The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL b…
• CVE-2014-8177The Red Hat gluster-swift package, as used in Red Hat Gluste…
• CVE-2014-8178Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2…5.5
• CVE-2014-8180MongoDB on Red Hat Satellite 6 allows local users to bypass …
• CVE-2014-8181The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not …5.5
• CVE-2014-8182An off-by-one error leading to a crash was discovered in ope…7.5
• CVE-2014-8183It was found that foreman, versions 1.x.x before 1.15.6, in …7.4
• CVE-2014-8184A vulnerability was found in liblouis, versions 2.5.x before…7.8
• CVE-2014-8185Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…