CVE-2014-5277
docker: fallback to HTTP when HTTPS connections to the registry fail
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · October 30, 2014
Updated · June 27, 2026
Description
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 5.1AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-319 · Cleartext Transmission of Sensitive Information