Security update for docker SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1757-1 Final 1 1 2015-10-14T07:53:41Z current 2015-10-14T07:53:41Z 2015-10-14T07:53:41Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for docker docker was updated to version 1.8.3 to fix two security issues. These security issues were fixed: - CVE-2014-8178: Manipulated layer IDs could have lead to local graph poisoning (bsc#949660). - CVE-2014-8179: Manifest validation and parsing logic errors allowed pull-by-digest validation bypass (bsc#949660). This non-security issues was fixed: - Add `--disable-legacy-registry` to prevent a daemon from using a v1 registry More information about docker 1.8.3 can be found at https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/ The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Containers-12-2015-691 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151757-1/ Link for SUSE-SU-2015:1757-1 https://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html E-Mail link for SUSE-SU-2015:1757-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/949660 SUSE Bug 949660 https://www.suse.com/security/cve/CVE-2014-8178/ SUSE CVE CVE-2014-8178 page https://www.suse.com/security/cve/CVE-2014-8179/ SUSE CVE CVE-2014-8179 page SUSE Linux Enterprise Module for Containers 12 docker-1.8.3-49.1 docker-1.8.3-49.1 as a component of SUSE Linux Enterprise Module for Containers 12 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands. CVE-2014-8178 SUSE Linux Enterprise Module for Containers 12:docker-1.8.3-49.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151757-1/ https://www.suse.com/security/cve/CVE-2014-8178.html CVE-2014-8178 https://bugzilla.suse.com/949660 SUSE Bug 949660 Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. CVE-2014-8179 SUSE Linux Enterprise Module for Containers 12:docker-1.8.3-49.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151757-1/ https://www.suse.com/security/cve/CVE-2014-8179.html CVE-2014-8179 https://bugzilla.suse.com/949660 SUSE Bug 949660