CVE-2014-5277 Man-in-the-Middle (MitM)
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi docker-py(PyPI) | < 0.5.3 | 0.5.3 |
| pypi docker-py(PyPI) | = 0.0.4 | No fix listed |
| pypi docker-py(PyPI) | = 0.0.5 | No fix listed |
| pypi docker-py(PyPI) | = 0.0.6 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.0 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.1 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.2 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.3 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.4 | No fix listed |
| pypi docker-py(PyPI) | = 0.1.5 | No fix listed |
| pypi docker-py(PyPI) | = 0.2.0 | No fix listed |
| pypi docker-py(PyPI) | = 0.2.1 | No fix listed |
| pypi docker-py(PyPI) | = 0.2.2 | No fix listed |
| pypi docker-py(PyPI) | = 0.2.3 | No fix listed |
| pypi docker-py(PyPI) | = 0.3.0 | No fix listed |
| pypi docker-py(PyPI) | = 0.3.1 | No fix listed |
| pypi docker-py(PyPI) | = 0.3.2 | No fix listed |
| pypi docker-py(PyPI) | = 0.4.0 | No fix listed |
| pypi docker-py(PyPI) | = 0.5.0 | No fix listed |
| pypi docker-py(PyPI) | = 0.5.1 | No fix listed |
| pypi docker-py(PyPI) | = 0.5.2 | No fix listed |
| docker github.com/docker/docker(Go) | < 1.3.1 | 1.3.1 |
| debian/docker.io(Debian:12) | < 1.3.1~dfsg1-1 | 1.3.1~dfsg1-1 |
| debian/docker.io(Debian:13) | < 1.3.1~dfsg1-1 | 1.3.1~dfsg1-1 |
| debian/docker.io(Debian:14) | < 1.3.1~dfsg1-1 | 1.3.1~dfsg1-1 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/docker | <= 1.3.0 | No fix listed |
| docker-py | <= 0.5.3 | No fix listed |
References
- openSUSE-SU-2014:1411 vendor-advisory
- groups.google.com
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- web.nvd.nist.gov
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-5277 vendor-advisory