Summary
generated automatically from NVD dataThe Red Hat docker package, in versions up to 1.5.0-27, mishandles the --add-registry option by falling back to plain HTTP when an HTTPS connection to the registry fails. A man-in-the-middle attacker able to block HTTPS traffic between client and registry can force this downgrade and capture authentication data and image data. The issue is described as a regression of CVE-2014-5277 and carries a CVSS v2.0 score of 4.3 (MEDIUM).
NVD description
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
EPSS · FIRST.org
1.6%probability of exploitation in the next 30 days
Higher than 76% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 6 avr. 2015
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- secalert@redhat.com
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (6)
- http://rhn.redhat.com/errata/RHSA-2015-0776.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0776.htmlVendor Advisory
Similar CVEs
Other vulnerabilities of type CWE-20
Running Docker? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.