PT-2015-5466 · Red Hat · Docker

Eric Windisch · Publicado 2015-04-06 · Atualizado 2016-07-26 · CVE-2015-1843

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat docker package versions prior to 1.5.0-28

Description The issue allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. This occurs when the Red Hat docker package falls back to HTTP after an HTTPS connection to the registry fails, specifically when using the --add-registry option.

Recommendations For versions prior to 1.5.0-28, update to version 1.5.0-28 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-1843

RHSA-2015:0776

Produtos afetados

Docker

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-1843 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1206443 · Nota
• http://securityfocus.com/bid/73936 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-0776.html · Aviso do Fabricante