High severity · published Feb 6, 2018
CVE-2014-5282
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'
8.1
CVSS
1.3%
EPSS
No
On KEV
Description
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Docker · Docker
before 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5282
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5282
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1168436
groups.google.com
https://groups.google.com/forum/#%21msg/docker-announce/aQoVmQlcE0A/smPuBNYf8VwJ
More from Docker
7.8
CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
9.8
CVE-2014-0048
An issue was found in Docker before 1.6.0
9.8
CVE-2019-14271
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that…
8.8
CVE-2020-14300
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053)…
8.8
CVE-2020-14298
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which…