Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03545-1 advisory.

    Note this update contains a already fixed references mostly.

    - Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. bsc#1250596

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Update to Go 1.23 for building now that upstream has switched their 23.0.x       LTSS to use Go 1.23.

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract     the manifest object from its JSON representation during a pull, which allows attackers to inject new     attributes in a JSON object and bypass pull-by-digest validation. (CVE-2014-8179)

Note that Nessus relies on the presence of the package as reported by the vendor.

Docker was updated to version 1.9.0, bringing features and bugfixes (bnc#954812) :

  - Runtime :

  - `docker stats` now returns block IO metrics (#15005)

  - `docker stats` now details network stats per interface     (#15786)

  - Add `ancestor=<image>` filter to `docker ps --filter`     flag to filter containers based on their ancestor images     (#14570)

  - Add `label=<somelabel>` filter to `docker ps --filter`     to filter containers based on label (#16530)

  - Add `--kernel-memory` flag to `docker run` (#14006)

  - Add `--message` flag to `docker import` allowing to     specify an optional message (#15711)

  - Add `--privileged` flag to `docker exec` (#14113)

  - Add `--stop-signal` flag to `docker run` allowing to     replace the container process stopping signal (#15307)

  - Add a new `unless-stopped` restart policy (#15348)

  - Inspecting an image now returns tags (#13185)

  - Add container size information to `docker inspect`     (#15796)

  - Add `RepoTags` and `RepoDigests` field to     `/images/(name:.*)/json` (#17275)

  - Remove the deprecated `/container/ps` endpoint from the     API (#15972)

  - Send and document correct HTTP codes for     `/exec/<name>/start` (#16250)

  - Share shm and mqueue between containers sharing IPC     namespace (#15862)

  - Event stream now shows OOM status when     `--oom-kill-disable` is set (#16235)

  - Ensure special network files (/etc/hosts etc.) are     read-only if bind-mounted with `ro` option (#14965)

  - Improve `rmi` performance (#16890)

  - Do not update /etc/hosts for the default bridge network,     except for links (#17325)

  - Fix conflict with duplicate container names (#17389)

  - Fix an issue with incorrect template execution in     `docker inspect` (#17284)

  - DEPRECATE `-c` short flag variant for `--cpu-shares` in     docker run (#16271)

  - Client :

  - Allow `docker import` to import from local files     (#11907)

  - Builder :

  - Add a `STOPSIGNAL` Dockerfile instruction allowing to     set a different stop-signal for the container process     (#15307)

  - Add an `ARG` Dockerfile instruction and a `--build-arg`     flag to `docker build` that allows to add build-time     environment variables (#15182)

  - Improve cache miss performance (#16890)

  - Storage :

  - devicemapper: Implement deferred deletion capability     (#16381)

  - Networking :

  - `docker network` exits experimental and is part of     standard release (#16645)

  - New network top-level concept, with associated     subcommands and API (#16645) WARNING: the API is     different from the experimental API

  - Support for multiple isolated/micro-segmented networks     (#16645)

  - Built-in multihost networking using VXLAN based overlay     driver (#14071)

  - Support for third-party network plugins (#13424)

  - Ability to dynamically connect containers to multiple     networks (#16645)

  - Support for user-defined IP address management via     pluggable IPAM drivers (#16910)

  - Add daemon flags `--cluster-store` and     `--cluster-advertise` for built-in nodes discovery     (#16229)

  - Add `--cluster-store-opt` for setting up TLS settings     (#16644)

  - Add `--dns-opt` to the daemon (#16031)

  - DEPRECATE following container `NetworkSettings` fields     in API v1.21: `EndpointID`, `Gateway`,     `GlobalIPv6Address`, `GlobalIPv6PrefixLen`, `IPAddress`,     `IPPrefixLen`, `IPv6Gateway` and `MacAddress`. Those are     now specific to the `bridge` network. Use     `NetworkSettings.Networks` to inspect the networking     settings of a container per network.

  - Volumes :

  - New top-level `volume` subcommand and API (#14242)

  - Move API volume driver settings to host-specific config     (#15798)

  - Print an error message if volume name is not unique     (#16009)

  - Ensure volumes created from Dockerfiles always use the     local volume driver (#15507)

  - DEPRECATE auto-creating missing host paths for bind     mounts (#16349)

  - Logging :

  - Add `awslogs` logging driver for Amazon CloudWatch     (#15495)

  - Add generic `tag` log option to allow customizing     container/image information passed to driver (e.g. show     container names) (#15384)

  - Implement the `docker logs` endpoint for the journald     driver (#13707)

  - DEPRECATE driver-specific log tags (e.g. `syslog-tag`,     etc.) (#15384)

  - Distribution :

  - `docker search` now works with partial names (#16509)

  - Push optimization: avoid buffering to file (#15493)

  - The daemon will display progress for images that were     already being pulled by another client (#15489)

  - Only permissions required for the current action being     performed are requested (#)

  - Renaming trust keys (and respective environment     variables) from `offline` to `root` and `tagging` to     `repository` (#16894)

  - DEPRECATE trust key environment variables     `DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE` and     `DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE` (#16894)

  - Security :

  - Add SELinux profiles to the rpm package (#15832)

  - Fix various issues with AppArmor profiles provided in     the deb package (#14609)

  - Add AppArmor policy that prevents writing to /proc     (#15571)

  - Change systemd unit file to no longer use the deprecated     '-d' option (bnc#954737)

  - Also docker was updated to the 1.8.3 version that fixes     security issues :

  - Fix layer IDs lead to local graph poisoning     (CVE-2014-8178) (bnc#949660)

  - Fix manifest validation and parsing logic errors allow     pull-by-digest validation bypass (CVE-2014-8179)

  - Add `--disable-legacy-registry` to prevent a daemon from     using a v1 registry

Docker was updated to 1.8.3 to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2014-8178: layer IDs lead to local graph poisoning     (boo#949660)

  - CVE-2014-8179: manifest validation and parsing logic     errors allow pull-by-digest validation bypass

In addition, the following change is included :

  - --disable-legacy-registry to prevent a daemon from using     a v1 registry

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-3085 advisory.

    - Fix layer IDs lead to local graph poisoning (CVE-2014-8178)
    - Fix manifest validation and parsing logic errors allow pull-by-digest validation bypass (CVE-2014-8179)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
270307	SUSE SLES15 / openSUSE 15 Security Update : docker-stable (SUSE-SU-2025:03545-1)	Nessus	SuSE Local Security Checks	critical
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	critical
218455	Linux Distros Unpatched Vulnerability : CVE-2014-8179	Nessus	Misc.	high
87017	openSUSE Security Update : docker (openSUSE-2015-792)	Nessus	SuSE Local Security Checks	high
86437	openSUSE Security Update : docker (openSUSE-2015-666)	Nessus	SuSE Local Security Checks	high
86395	Oracle Linux 6 / 7 : docker-engine (ELSA-2015-3085)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2014-8179

high

Tenable Plugins

critical

critical

high

high

high

high