| Package | Affected versions | Patched versions |
|---|---|---|
| cs engine | < 1.6.2-cs7 | 1.6.2-cs7 |
| docker | < 1.8.3 | 1.8.3 |
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free