CVE-2014-8179: docker cs docker engine Improper Input Validation
Vulnerability summary
CVE-2014-8179 is a high (CVSS 7.5) Improper Input Validation vulnerability in docker cs docker engine. EPSS estimates a 2.73% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 04-12-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
2.73%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.73% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Docker4 products
- cs docker engine< 1.6.2-CS7
- cs_engine< 1.6.2-cs7
- docker< 1.8.3
- docker engine< 1.8.3
Debian1 product
- docker.io< 1.8.3~ds1-1
Opensuse1 product
- opensuseEOL13.2
Ubuntu1 product
- docker.io< 1.10.3-0ubuntu6
4 vendors · 7 products
References
10 links- lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.htmlX Refsource MISCThird Party Advisory
- groups.google.com/forum/X Refsource MISC
- blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/X Refsource MISCNot ApplicableVendor Advisory
