Lucene search

PRIOn knowledge basePRION:CVE-2014-5277

HistoryNov 17, 2014 - 4:59 p.m.

Authentication flaw

2014-11-1716:59:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

49.2%

JSON

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.

CPENameOperatorVersion
dockerle1.3.0
docker-pyle0.5.3

CPE	Name	Operator	Version
	docker	le	1.3.0
	docker-py	le	0.5.3

References

lists.opensuse.org/opensuse-updates/2014-11/msg00048.html

groups.google.com/forum/