PT-2014-6389 · Docker+1 · Docker-Py+2
Published
2014-11-17
·
Updated
2025-10-11
·
CVE-2014-5277
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Docker versions prior to 1.3.1
docker-py versions prior to 0.5.3
Description
The issue allows man-in-the-middle attackers to conduct downgrade attacks. This can be achieved by leveraging a network position between the client and the registry to block HTTPS traffic, causing the client to fall back to HTTP. As a result, attackers can obtain authentication and image data.
Recommendations
For Docker versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue.
For docker-py versions prior to 0.5.3, update to version 0.5.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the Docker registry to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Docker
Suse
Docker-Py