CVE-2015-1843
Description
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
Risk Information
Base Score
7.5
MODERATE
Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
1.125
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Update docker 1.5.0-27 to latest version | Windows |
| (RHSA-2015:0776) Moderate: docker security update atomic-0-0.9.git4ff7dbd.el7.x86_64.rpm | Linux |
| (RHSA-2015:0776) Moderate: docker security update docker-python-1.0.0-22.el7.x86_64.rpm | Linux |
| (RHSA-2015:0776) Moderate: docker security update python-websocket-client-0.14.1-65.el7.noarch.rpm | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234