Vulnerabilities > CVE-2014-8179 - Improper Input Validation vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
docker
opensuse
CWE-20
nessus
NVD
Published: 2019-12-17
Updated: 2023-02-13

Summary

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

Vulnerable Configurations

Part Description Count
Application
Docker
85
OS
Opensuse
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-3085.NASL
    descriptionDescription of changes: [1.8.3-1.0.1] - Enable configuration of Docker daemon via sysconfig [orabug 21804877] - Add documentation files to binary RPM [1.8.3] - Fix layer IDs lead to local graph poisoning (CVE-2014-8178) - Fix manifest validation and parsing logic errors allow pull-by-digest validation bypass (CVE-2014-8179) - Add --disable-legacy-registry to prevent a daemon from using a v1 registry
    last seen2020-06-01
    modified2020-06-02
    plugin id86395
    published2015-10-15
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86395
    titleOracle Linux 6 / 7 : docker-engine (ELSA-2015-3085)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2015-3085.
#

include("compat.inc");

if (description)
{
  script_id(86395);
  script_version("2.4");
  script_cvs_date("Date: 2019/12/23");

  script_cve_id("CVE-2014-8178", "CVE-2014-8179");

  script_name(english:"Oracle Linux 6 / 7 : docker-engine (ELSA-2015-3085)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Oracle Linux host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Description of changes:

[1.8.3-1.0.1]
- Enable configuration of Docker daemon via sysconfig [orabug 21804877]
- Add documentation files to binary RPM

[1.8.3]
- Fix layer IDs lead to local graph poisoning (CVE-2014-8178)
- Fix manifest validation and parsing logic errors allow pull-by-digest 
validation bypass (CVE-2014-8179)
- Add --disable-legacy-registry to prevent a daemon from using a v1 registry"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2015-October/005455.html"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2015-October/005456.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected docker-engine package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:docker-engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/10/15");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Oracle Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6 / 7", "Oracle Linux " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

flag = 0;
if (rpm_check(release:"EL6", cpu:"x86_64", reference:"docker-engine-1.8.3-1.0.1.el6")) flag++;

if (rpm_check(release:"EL7", cpu:"x86_64", reference:"docker-engine-1.8.3-1.0.1.el7")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "docker-engine");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-666.NASL
    descriptionDocker was updated to 1.8.3 to fix two security issues. The following vulnerabilities were fixed : - CVE-2014-8178: layer IDs lead to local graph poisoning (boo#949660) - CVE-2014-8179: manifest validation and parsing logic errors allow pull-by-digest validation bypass In addition, the following change is included : - --disable-legacy-registry to prevent a daemon from using a v1 registry
    last seen2020-06-05
    modified2015-10-19
    plugin id86437
    published2015-10-19
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86437
    titleopenSUSE Security Update : docker (openSUSE-2015-666)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2015-666.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(86437);
  script_version("2.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2014-8178", "CVE-2014-8179");

  script_name(english:"openSUSE Security Update : docker (openSUSE-2015-666)");
  script_summary(english:"Check for the openSUSE-2015-666 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Docker was updated to 1.8.3 to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2014-8178: layer IDs lead to local graph poisoning
    (boo#949660)

  - CVE-2014-8179: manifest validation and parsing logic
    errors allow pull-by-digest validation bypass

In addition, the following change is included :

  - --disable-legacy-registry to prevent a daemon from using
    a v1 registry"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=949660"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected docker packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-bash-completion");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-zsh-completion");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/10/19");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE13.2", reference:"docker-1.8.3-43.1") ) flag++;
if ( rpm_check(release:"SUSE13.2", reference:"docker-bash-completion-1.8.3-43.1") ) flag++;
if ( rpm_check(release:"SUSE13.2", reference:"docker-debuginfo-1.8.3-43.1") ) flag++;
if ( rpm_check(release:"SUSE13.2", reference:"docker-debugsource-1.8.3-43.1") ) flag++;
if ( rpm_check(release:"SUSE13.2", reference:"docker-test-1.8.3-43.1") ) flag++;
if ( rpm_check(release:"SUSE13.2", reference:"docker-zsh-completion-1.8.3-43.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "docker / docker-bash-completion / docker-debuginfo / etc");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-792.NASL
    descriptionDocker was updated to version 1.9.0, bringing features and bugfixes (bnc#954812) : - Runtime : - `docker stats` now returns block IO metrics (#15005) - `docker stats` now details network stats per interface (#15786) - Add `ancestor=<image>` filter to `docker ps --filter` flag to filter containers based on their ancestor images (#14570) - Add `label=<somelabel>` filter to `docker ps --filter` to filter containers based on label (#16530) - Add `--kernel-memory` flag to `docker run` (#14006) - Add `--message` flag to `docker import` allowing to specify an optional message (#15711) - Add `--privileged` flag to `docker exec` (#14113) - Add `--stop-signal` flag to `docker run` allowing to replace the container process stopping signal (#15307) - Add a new `unless-stopped` restart policy (#15348) - Inspecting an image now returns tags (#13185) - Add container size information to `docker inspect` (#15796) - Add `RepoTags` and `RepoDigests` field to `/images/(name:.*)/json` (#17275) - Remove the deprecated `/container/ps` endpoint from the API (#15972) - Send and document correct HTTP codes for `/exec/<name>/start` (#16250) - Share shm and mqueue between containers sharing IPC namespace (#15862) - Event stream now shows OOM status when `--oom-kill-disable` is set (#16235) - Ensure special network files (/etc/hosts etc.) are read-only if bind-mounted with `ro` option (#14965) - Improve `rmi` performance (#16890) - Do not update /etc/hosts for the default bridge network, except for links (#17325) - Fix conflict with duplicate container names (#17389) - Fix an issue with incorrect template execution in `docker inspect` (#17284) - DEPRECATE `-c` short flag variant for `--cpu-shares` in docker run (#16271) - Client : - Allow `docker import` to import from local files (#11907) - Builder : - Add a `STOPSIGNAL` Dockerfile instruction allowing to set a different stop-signal for the container process (#15307) - Add an `ARG` Dockerfile instruction and a `--build-arg` flag to `docker build` that allows to add build-time environment variables (#15182) - Improve cache miss performance (#16890) - Storage : - devicemapper: Implement deferred deletion capability (#16381) - Networking : - `docker network` exits experimental and is part of standard release (#16645) - New network top-level concept, with associated subcommands and API (#16645) WARNING: the API is different from the experimental API - Support for multiple isolated/micro-segmented networks (#16645) - Built-in multihost networking using VXLAN based overlay driver (#14071) - Support for third-party network plugins (#13424) - Ability to dynamically connect containers to multiple networks (#16645) - Support for user-defined IP address management via pluggable IPAM drivers (#16910) - Add daemon flags `--cluster-store` and `--cluster-advertise` for built-in nodes discovery (#16229) - Add `--cluster-store-opt` for setting up TLS settings (#16644) - Add `--dns-opt` to the daemon (#16031) - DEPRECATE following container `NetworkSettings` fields in API v1.21: `EndpointID`, `Gateway`, `GlobalIPv6Address`, `GlobalIPv6PrefixLen`, `IPAddress`, `IPPrefixLen`, `IPv6Gateway` and `MacAddress`. Those are now specific to the `bridge` network. Use `NetworkSettings.Networks` to inspect the networking settings of a container per network. - Volumes : - New top-level `volume` subcommand and API (#14242) - Move API volume driver settings to host-specific config (#15798) - Print an error message if volume name is not unique (#16009) - Ensure volumes created from Dockerfiles always use the local volume driver (#15507) - DEPRECATE auto-creating missing host paths for bind mounts (#16349) - Logging : - Add `awslogs` logging driver for Amazon CloudWatch (#15495) - Add generic `tag` log option to allow customizing container/image information passed to driver (e.g. show container names) (#15384) - Implement the `docker logs` endpoint for the journald driver (#13707) - DEPRECATE driver-specific log tags (e.g. `syslog-tag`, etc.) (#15384) - Distribution : - `docker search` now works with partial names (#16509) - Push optimization: avoid buffering to file (#15493) - The daemon will display progress for images that were already being pulled by another client (#15489) - Only permissions required for the current action being performed are requested (#) - Renaming trust keys (and respective environment variables) from `offline` to `root` and `tagging` to `repository` (#16894) - DEPRECATE trust key environment variables `DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE` and `DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE` (#16894) - Security : - Add SELinux profiles to the rpm package (#15832) - Fix various issues with AppArmor profiles provided in the deb package (#14609) - Add AppArmor policy that prevents writing to /proc (#15571) - Change systemd unit file to no longer use the deprecated
    last seen2020-06-05
    modified2015-11-24
    plugin id87017
    published2015-11-24
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87017
    titleopenSUSE Security Update : docker (openSUSE-2015-792)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2015-792.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(87017);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2014-8178", "CVE-2014-8179");

  script_name(english:"openSUSE Security Update : docker (openSUSE-2015-792)");
  script_summary(english:"Check for the openSUSE-2015-792 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Docker was updated to version 1.9.0, bringing features and bugfixes
(bnc#954812) :

  - Runtime :

  - `docker stats` now returns block IO metrics (#15005)

  - `docker stats` now details network stats per interface
    (#15786)

  - Add `ancestor=<image>` filter to `docker ps --filter`
    flag to filter containers based on their ancestor images
    (#14570)

  - Add `label=<somelabel>` filter to `docker ps --filter`
    to filter containers based on label (#16530)

  - Add `--kernel-memory` flag to `docker run` (#14006)

  - Add `--message` flag to `docker import` allowing to
    specify an optional message (#15711)

  - Add `--privileged` flag to `docker exec` (#14113)

  - Add `--stop-signal` flag to `docker run` allowing to
    replace the container process stopping signal (#15307)

  - Add a new `unless-stopped` restart policy (#15348)

  - Inspecting an image now returns tags (#13185)

  - Add container size information to `docker inspect`
    (#15796)

  - Add `RepoTags` and `RepoDigests` field to
    `/images/(name:.*)/json` (#17275)

  - Remove the deprecated `/container/ps` endpoint from the
    API (#15972)

  - Send and document correct HTTP codes for
    `/exec/<name>/start` (#16250)

  - Share shm and mqueue between containers sharing IPC
    namespace (#15862)

  - Event stream now shows OOM status when
    `--oom-kill-disable` is set (#16235)

  - Ensure special network files (/etc/hosts etc.) are
    read-only if bind-mounted with `ro` option (#14965)

  - Improve `rmi` performance (#16890)

  - Do not update /etc/hosts for the default bridge network,
    except for links (#17325)

  - Fix conflict with duplicate container names (#17389)

  - Fix an issue with incorrect template execution in
    `docker inspect` (#17284)

  - DEPRECATE `-c` short flag variant for `--cpu-shares` in
    docker run (#16271)

  - Client :

  - Allow `docker import` to import from local files
    (#11907)

  - Builder :

  - Add a `STOPSIGNAL` Dockerfile instruction allowing to
    set a different stop-signal for the container process
    (#15307)

  - Add an `ARG` Dockerfile instruction and a `--build-arg`
    flag to `docker build` that allows to add build-time
    environment variables (#15182)

  - Improve cache miss performance (#16890)

  - Storage :

  - devicemapper: Implement deferred deletion capability
    (#16381)

  - Networking :

  - `docker network` exits experimental and is part of
    standard release (#16645)

  - New network top-level concept, with associated
    subcommands and API (#16645) WARNING: the API is
    different from the experimental API

  - Support for multiple isolated/micro-segmented networks
    (#16645)

  - Built-in multihost networking using VXLAN based overlay
    driver (#14071)

  - Support for third-party network plugins (#13424)

  - Ability to dynamically connect containers to multiple
    networks (#16645)

  - Support for user-defined IP address management via
    pluggable IPAM drivers (#16910)

  - Add daemon flags `--cluster-store` and
    `--cluster-advertise` for built-in nodes discovery
    (#16229)

  - Add `--cluster-store-opt` for setting up TLS settings
    (#16644)

  - Add `--dns-opt` to the daemon (#16031)

  - DEPRECATE following container `NetworkSettings` fields
    in API v1.21: `EndpointID`, `Gateway`,
    `GlobalIPv6Address`, `GlobalIPv6PrefixLen`, `IPAddress`,
    `IPPrefixLen`, `IPv6Gateway` and `MacAddress`. Those are
    now specific to the `bridge` network. Use
    `NetworkSettings.Networks` to inspect the networking
    settings of a container per network.

  - Volumes :

  - New top-level `volume` subcommand and API (#14242)

  - Move API volume driver settings to host-specific config
    (#15798)

  - Print an error message if volume name is not unique
    (#16009)

  - Ensure volumes created from Dockerfiles always use the
    local volume driver (#15507)

  - DEPRECATE auto-creating missing host paths for bind
    mounts (#16349)

  - Logging :

  - Add `awslogs` logging driver for Amazon CloudWatch
    (#15495)

  - Add generic `tag` log option to allow customizing
    container/image information passed to driver (e.g. show
    container names) (#15384)

  - Implement the `docker logs` endpoint for the journald
    driver (#13707)

  - DEPRECATE driver-specific log tags (e.g. `syslog-tag`,
    etc.) (#15384)

  - Distribution :

  - `docker search` now works with partial names (#16509)

  - Push optimization: avoid buffering to file (#15493)

  - The daemon will display progress for images that were
    already being pulled by another client (#15489)

  - Only permissions required for the current action being
    performed are requested (#)

  - Renaming trust keys (and respective environment
    variables) from `offline` to `root` and `tagging` to
    `repository` (#16894)

  - DEPRECATE trust key environment variables
    `DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE` and
    `DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE` (#16894)

  - Security :

  - Add SELinux profiles to the rpm package (#15832)

  - Fix various issues with AppArmor profiles provided in
    the deb package (#14609)

  - Add AppArmor policy that prevents writing to /proc
    (#15571)

  - Change systemd unit file to no longer use the deprecated
    '-d' option (bnc#954737)

  - Also docker was updated to the 1.8.3 version that fixes
    security issues :

  - Fix layer IDs lead to local graph poisoning
    (CVE-2014-8178) (bnc#949660)

  - Fix manifest validation and parsing logic errors allow
    pull-by-digest validation bypass (CVE-2014-8179)

  - Add `--disable-legacy-registry` to prevent a daemon from
    using a v1 registry"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=949660"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954737"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954812"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected docker packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-bash-completion");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:docker-zsh-completion");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/24");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.1", reference:"docker-1.9.0-4.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"docker-bash-completion-1.9.0-4.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"docker-debuginfo-1.9.0-4.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"docker-debugsource-1.9.0-4.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"docker-test-1.9.0-4.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"docker-zsh-completion-1.9.0-4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "docker / docker-bash-completion / docker-debuginfo / etc");
}

References