CVE-2014-8179: Docker Cs Engine

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

Affected products

• Docker Cs Engine: before 1.6.2-cs7 (fixed in 1.6.2-cs7)
• Docker Docker: before 1.8.3 (fixed in 1.8.3)
• Opensuse Opensuse: version 13.2 only

Published 2019-12-17. Last modified 2026-06-17.