PyPI/docker-py CVE-2014-5277: unknown, EPSS 1.87%
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authe
Action: Upgrade docker-py to 0.5.3 or later.
pip install docker-py==0.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.3 | - |
Fixed versions
| 0.5.3 |
Sources
- osv: PYSEC-2014-80
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html
- https://groups.google.com/forum/#!topic/docker-user/oYm0i3xShJU
CVE-2014-5277 · published · modified · JSON