PT-2015-5466 · Red Hat · Docker

Eric Windisch · Published 2015-04-06 · Updated 2016-07-26 · CVE-2015-1843

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Red Hat docker package versions prior to 1.5.0-28

Description The issue allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. This occurs when the Red Hat docker package falls back to HTTP after an HTTPS connection to the registry fails, specifically when using the --add-registry option.

Recommendations For versions prior to 1.5.0-28, update to version 1.5.0-28 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-1843

RHSA-2015:0776

Affected Products

Docker

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-1843 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0776.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1206443 · Note
• http://securityfocus.com/bid/73936 · Note