{"action":"Upgrade docker-py to 0.5.3 or later.","affected":[{"fixed":"0.5.3","introduced":"0"}],"component":"docker-py","cve_ids":["CVE-2014-5277"],"ecosystem":"PyPI","epss":0.01867,"exploited":false,"fixed_versions":["0.5.3"],"ghsa_id":"GHSA-8w94-cf6g-c8mg","id":"tcs_01M5KG6DZZVNYE5XGV6E5KP87S","modified_at":"2024-08-21T15:26:43.035056Z","published_at":"2014-11-17T16:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2014-80","http://lists.opensuse.org/opensuse-updates/2014-11/msg00048.html","https://groups.google.com/forum/#!topic/docker-user/oYm0i3xShJU"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2014-80","url":"https://osv.dev/vulnerability/PYSEC-2014-80"}],"summary":"Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authe"}