CVE-2014-5277: Medium severity Docker docker vulnerability
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5277?
CVE-2014-5277 has been classified as a moderate severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2014-5277?
To resolve CVE-2014-5277, upgrade Docker to version 1.3.1 or higher and docker-py to version 0.5.3 or higher.
What systems are affected by CVE-2014-5277?
CVE-2014-5277 affects Docker versions prior to 1.3.1 and docker-py versions prior to 0.5.3.
What does CVE-2014-5277 exploit?
CVE-2014-5277 exploits the fallback to HTTP when HTTPS connections to the registry fail, allowing downgrade attacks.
Can I use Docker without addressing CVE-2014-5277?
While you can continue using Docker, failing to address CVE-2014-5277 increases the risk of data interception during image retrieval.