CVE-2014-5277 describes a vulnerability in Docker before version 1.3.1 and docker-py before 0.5.3, where the client would downgrade to HTTP if an HTTPS connection to the registry failed. This allowed man-in-the-middle attackers to conduct downgrade attacks, intercepting authentication and image data by blocking HTTPS traffic. With a CVSS score of 5.0, this vulnerability has a network attack vector and low attack complexity, potentially leading to information disclosure. While not listed on the KEV catalog, there is some community discussion and media coverage, indicating awareness, but no known active exploits or public exploit code like Metasploit or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.3.0CPE matchmatch criteria | cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* | ||
<= 0.5.3CPE matchmatch criteria | cpe:2.3:a:docker:docker-py:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Man-in-the-Middle (MitM)
Feb 15, 2022CVE-2014-5277
Jul 13, 2021Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Nov 2, 2014docker: fallback to HTTP when HTTPS connections to the registry fail
Oct 30, 2014