id: PYSEC-2014-80
details: Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the
  HTTPS connection to the registry fails, which allows man-in-the-middle attackers
  to conduct downgrade attacks and obtain authentication and image data by leveraging
  a network position between the client and the registry to block HTTPS traffic.
affected:
- package:
    name: docker-py
    ecosystem: PyPI
    purl: pkg:pypi/docker-py
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.5.3
  versions:
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.4.0
  - 0.5.0
  - 0.5.1
  - 0.5.2
references:
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html
- type: WEB
  url: https://groups.google.com/forum/#!topic/docker-user/oYm0i3xShJU
aliases:
- CVE-2014-5277
modified: "2021-08-27T03:22:03.349219Z"
published: "2014-11-17T16:59:00Z"