CVE-2014-5277: Man-in-the-Middle (MitM) in Docker
Summary
CVE-2014-5277: Man-in-the-Middle (MitM). Affects github.com/docker/docker versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
The same CVE-2014-5277 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker is an open-source platform that automates the deployment, scaling, and management of applications using containerization. It allows developers to package their applications and dependencies into a standardized unit called a container, which can be easily deployed across different environments. Docker is written in Go and is widely used in the software development industry.
Vulnerability Detail
The vulnerability, known as CVE-2014-5277, affects Docker versions before 1.3.1 and docker-py versions before 0.5.3. It involves a man-in-the-middle (MitM) attack, where an attacker intercepts the communication between the Docker client and the registry. In this case, if the HTTPS connection to the registry fails, Docker falls back to using HTTP, which can be exploited by an attacker in a network position between the client and the registry. By blocking HTTPS traffic, the attacker can conduct downgrade attacks and gain unauthorized access to authentication and image data. This vulnerability poses a moderate risk and can lead to unauthorized access and potential data breaches.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that their Docker client and docker-py libraries are updated to the fixed versions mentioned above.
Conclusion
In conclusion, the CVE-2014-5277 vulnerability in Docker and docker-py allows man-in-the-middle attacks, potentially leading to unauthorized access and data breaches. To mitigate this risk, it is crucial to upgrade to the fixed versions of Docker and docker-py. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker is an open-source platform that automates the deployment, scaling, and management of applications using containerization. It allows developers to package their applications and dependencies into a standardized unit called a container, which can be easily deployed across different environments.
A man-in-the-middle (MitM) attack is a type of cyber attack where an attacker intercepts the communication between two parties and can eavesdrop on or modify the communication. In the case of this vulnerability, the attacker intercepts the communication between the Docker client and the registry to gain unauthorized access to authentication and image data.
This vulnerability can lead to unauthorized access to authentication and image data stored in Docker registries. It can also enable attackers to conduct downgrade attacks, compromising the security of the Docker environment and potentially leading to data breaches.
To fix this vulnerability, you should upgrade your Docker installation to version 1.3.1 or later. If you are using docker-py, make sure to upgrade to version 0.5.3 or later. These updates address the issue and prevent Docker from falling back to insecure HTTP connections.
While there is no specific workaround mentioned for this vulnerability, you can mitigate the risk by ensuring that your Docker client and docker-py libraries are updated to the fixed versions. This will prevent the fallback to HTTP and reduce the likelihood of a man-in-the-middle attack.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
