CVE-2014-5277
docker: no CVSS score yet. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in github.com/docker/docker 1.3.1.
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-17
- Published
- Modified
- Record from
- the NVD, synced
Affected
- docker:docker
- docker:docker-py
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8w94-cf6g-c8mg | Go | github.com/docker/docker | <1.3.1 | 1.3.1 |
| GO-2022-0636 | Go | github.com/docker/docker | <1.3.1 | 1.3.1 |
| PYSEC-2014-80 | PyPI | docker-py | <0.5.3 | 0.5.3 |