Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2014-5279: boot2docker allows remote access without authentication
CVE-2014-5279 · published 8 years ago
Summary
boot2docker versions 1.2 and earlier start the Docker service with an open network connection that does not require a username or password. This lets anyone on the same network talk to Docker and potentially take control of containers or run code inside them. Update to a newer boot2docker release or reconfigure the Docker daemon to require secure authentication before it can be accessed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| boot2docker | boot2docker |
<= 1.2 cpe:2.3:o:boot2docker:boot2docker:*:*:*:*:*:*:*:* |
Original advisory text
The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attackers to gain privileges or execute arbi...
The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default, which makes it easier for remote attackers to gain privileges or execute arbitrary code from children containers.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-284Improper Access Control
Timeline
Published6 Feb 2018
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-5279 · NVD
Track software like this
Free during beta