CVE catalog

CVE-2017-14992

docker.io: CVE-2017-14992

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.45% · Oct 25, 2026

Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandocker.iosid28.5.2+dfsg4-5fixed
Debiandocker.ioforky28.5.2+dfsg4-5fixed
Debiandocker.iotrixie26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iotrixie-security26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iobookworm20.10.24+dfsg1-1+deb12u1fixed
Debiangolang-github-vbatts-tar-splitsid0.12.3-1fixed
Debiangolang-github-vbatts-tar-splitforky0.12.3-1fixed
Debiangolang-github-vbatts-tar-splittrixie0.11.6-1fixed
Debiangolang-github-vbatts-tar-splitbookworm0.11.2+ds1-1fixed
Susecontainerdopenstack cloud 60.2.9+gitr706_06b9cb351610-16.8.1fixed
Susedockeropenstack cloud 617.09.1_ce-98.8.1fixed
Susedocker-runcopenstack cloud 61.0.0rc4+gitr3338_3f2f8b84a77f-1.3.1fixed
Susegolang-github-docker-libnetworkopenstack cloud 60.7.0.1+gitr2066_7b2b1feb1de4-10.1fixed
Susecontainerdlinux enterprise module for containers 120.2.9+gitr706_06b9cb351610-16.8.1fixed
Susedockerlinux enterprise module for containers 1217.09.1_ce-98.8.1fixed
Susedocker-runclinux enterprise module for containers 121.0.0rc4+gitr3338_3f2f8b84a77f-1.3.1fixed
Susegolang-github-docker-libnetworklinux enterprise module for containers 120.7.0.1+gitr2066_7b2b1feb1de4-10.1fixed
Opensuseskopeotumbleweed1.2.3-1.2fixed
Ubuntudocker.io16.041.6.2~dfsg1-1ubuntu4vulnerable
Ubuntudocker.io16.041.10.2-0ubuntu3vulnerable
Ubuntudocker.io16.041.10.2-0ubuntu4vulnerable
Ubuntudocker.io16.041.10.3-0ubuntu1vulnerable
Ubuntudocker.io16.041.10.3-0ubuntu4vulnerable
Ubuntudocker.io16.041.10.3-0ubuntu5vulnerable
Ubuntudocker.io16.041.10.3-0ubuntu6vulnerable
Ubuntudocker.io16.041.11.2-0ubuntu5~16.04vulnerable
Ubuntudocker.io16.041.12.1-0ubuntu13~16.04.1vulnerable
Ubuntudocker.io16.041.12.3-0ubuntu4~16.04.2vulnerable
Ubuntudocker.io16.041.12.6-0ubuntu1~16.04.1vulnerable
Ubuntudocker.io16.041.13.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.io16.0417.03.2-0ubuntu2~16.04.1vulnerable
Ubuntudocker.io16.0418.06.1-0ubuntu1~16.04.2fixed
Ubuntugolang-github-vbatts-tar-split16.040.9.7-2vulnerable
Ubuntugolang-github-vbatts-tar-split16.040.9.10-1vulnerable
Ubuntudocker.io18.041.13.1-0ubuntu6vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu1vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu3vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu5vulnerable
Ubuntudocker.io18.0417.12.1-0ubuntu1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1~18.04.1fixed
Opensusegovulncheck-vulndbtumbleweed0.0.20250424T181457-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandocker.iosourcesid18.03.1+dfsg1-2not yet assignedNot reported[908055]
Debiandocker.iosourceforky18.03.1+dfsg1-2not yet assignedNot reported[908055]
Debiandocker.iosourcetrixie18.03.1+dfsg1-2not yet assignedNot reported[908055]
Debiandocker.iosourcebookworm18.03.1+dfsg1-2not yet assignedNot reported[908055]
Debiangolang-github-vbatts-tar-splitsourcesid0.10.2-1not yet assignedNot reported[908056]
Debiangolang-github-vbatts-tar-splitsourceforky0.10.2-1not yet assignedNot reported[908056]
Debiangolang-github-vbatts-tar-splitsourcetrixie0.10.2-1not yet assignedNot reported[908056]
Debiangolang-github-vbatts-tar-splitsourcebookworm0.10.2-1not yet assignedNot reported[908056]
Susecontainerdrpmopenstack cloud 60.2.9+gitr706_06b9cb351610-16.8.1Not reportedSUSE-SU-2018:0386-1Not reported
Susedockerrpmopenstack cloud 617.09.1_ce-98.8.1Not reportedSUSE-SU-2018:0386-1Not reported
Susedocker-runcrpmopenstack cloud 61.0.0rc4+gitr3338_3f2f8b84a77f-1.3.1Not reportedSUSE-SU-2018:0386-1Not reported
Susegolang-github-docker-libnetworkrpmopenstack cloud 60.7.0.1+gitr2066_7b2b1feb1de4-10.1Not reportedSUSE-SU-2018:0386-1Not reported
Susecontainerdrpmlinux enterprise module for containers 120.2.9+gitr706_06b9cb351610-16.8.1Not reportedSUSE-SU-2018:0386-1Not reported
Susedockerrpmlinux enterprise module for containers 1217.09.1_ce-98.8.1Not reportedSUSE-SU-2018:0386-1Not reported
Susedocker-runcrpmlinux enterprise module for containers 121.0.0rc4+gitr3338_3f2f8b84a77f-1.3.1Not reportedSUSE-SU-2018:0386-1Not reported
Susegolang-github-docker-libnetworkrpmlinux enterprise module for containers 120.7.0.1+gitr2066_7b2b1feb1de4-10.1Not reportedSUSE-SU-2018:0386-1Not reported
Opensuseskopeorpmtumbleweed1.2.3-1.2Not reportedOPENSUSE-SU-2024:11385-1Not reported
Ubuntudocker.iodeb16.0418.06.1-0ubuntu1~16.04.2Not reportedUBUNTU-CVE-2017-14992Not reported
Ubuntudocker.iodeb18.0418.06.1-0ubuntu1~18.04.1Not reportedUBUNTU-CVE-2017-14992Not reported
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250424T181457-1.1Not reportedOPENSUSE-SU-2025:15033-1Not reported

[Debian bug #908055][Debian bug #908056]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (2)

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • [docker.io]Unknown

    Source package: [docker.io]

    Details (2)

    • 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • [golang-github-docker-docker-dev]Unknown

    Source package: [docker.io]

    Details (2)

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • [golang-github-vbatts-tar-split-dev]Unknown

    Source package: [golang-github-vbatts-tar-split]

    Details (2)

    • 0.11.2+ds1-1 · all · bookworm

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · bookworm; dsa · golang-github-vbatts-tar-split · debian · 12

    • 0.11.2+ds1-1 · all · bookworm

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · bookworm; dsa · golang-github-vbatts-tar-split · debian · 12

  • [tar-split]Unknown

    Source package: [golang-github-vbatts-tar-split]

    Details (2)

    • 0.11.2+ds1-1+b4 · amd64 · bookworm

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · bookworm; dsa · golang-github-vbatts-tar-split · debian · 12

    • 0.11.2+ds1-1+b4 · arm64 · bookworm

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · bookworm; dsa · golang-github-vbatts-tar-split · debian · 12

[Debian 13 (Trixie)]

  • [docker-cli]Unknown

    Source package: [docker.io]

    Details (4)

    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (4)

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

  • [docker.io]Unknown
    Details (4)

    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

  • [golang-github-docker-docker-dev]Unknown

    Source package: [docker.io]

    Details (4)

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 18.03.1+dfsg1-2

      dsa · docker.io · debian · 13

  • [golang-github-vbatts-tar-split-dev]Unknown

    Source package: [golang-github-vbatts-tar-split]

    Details (2)

    • 0.11.6-1 · all · trixie

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · 13

    • 0.11.6-1 · all · trixie

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · 13

  • [tar-split]Unknown

    Source package: [golang-github-vbatts-tar-split]

    Details (2)

    • 0.11.6-1+b5 · amd64 · trixie

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · 13

    • 0.11.6-1+b5 · arm64 · trixie

      Fixed · Fixed: 0.10.2-1

      dsa · golang-github-vbatts-tar-split · debian · 13

[openSUSE Tumbleweed]

  • [govulncheck-vulndb]Unknown

    Source package: [govulncheck-vulndb]

    Details (1)

    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250424T181457-1.1

      dsa · govulncheck-vulndb · opensuse · tumbleweed

  • [skopeo]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.2.3-1.2

      dsa · skopeo · opensuse · tumbleweed

  • [skopeo-bash-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.3-1.2

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

  • [skopeo-fish-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.3-1.2

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

  • [skopeo-zsh-completion]Unknown

    Source package: [skopeo]

    Details (1)

    • 1.24.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.3-1.2

      Version impact unknown

      dsa · skopeo · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]