CVE-2014-5277

Name of the Vulnerable Software and Affected Versions Docker versions prior to 1.3.1 docker-py versions prior to 0.5.3

Description The issue allows man-in-the-middle attackers to conduct downgrade attacks. This can be achieved by leveraging a network position between the client and the registry to block HTTPS traffic, causing the client to fall back to HTTP. As a result, attackers can obtain authentication and image data.

Recommendations For Docker versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. For docker-py versions prior to 0.5.3, update to version 0.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Docker registry to minimize the risk of exploitation.