CVE-2014-5277: Man-in-the-Middle (MitM) in github.com/docker/docker
Summary
CVE-2014-5277: Man-in-the-Middle (MitM) in github.com/docker/docker. Affects github.com/docker/docker versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
The same CVE-2014-5277 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/docker/docker is written in Go and is used for containerization. It provides a platform for developers to build, package, and distribute applications as containers. Containers are lightweight, isolated environments that allow applications to run consistently across different systems. However, a vulnerability has been identified in this package that could allow an attacker to perform a Man-in-the-Middle (MitM) attack.
Vulnerability Detail
The Man-in-the-Middle (MitM) vulnerability in github.com/docker/docker allows an attacker to intercept and modify communication between the Docker client and server. By exploiting this vulnerability, an attacker can eavesdrop on sensitive information, inject malicious code, or tamper with data being transmitted. This can lead to unauthorized access, data breaches, and potential compromise of the entire containerized environment.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package as soon as possible to mitigate the risk of a Man-in-the-Middle attack.
Conclusion
The Man-in-the-Middle (MitM) vulnerability in github.com/docker/docker poses a significant risk to applications utilizing this package. It is crucial to update to the fixed version (1.3.1 or later) to mitigate the risk of unauthorized access, data breaches, and compromise of the containerized environment.
See every vulnerability recorded for github.com/docker/docker →
FAQ
A Man-in-the-Middle (MitM) attack is a type of cyber attack where an attacker intercepts and alters communication between two parties without their knowledge. The attacker can eavesdrop on sensitive information, inject malicious code, or tamper with data being transmitted.
If your application uses the vulnerable version of the github.com/docker/docker package, an attacker can perform a Man-in-the-Middle attack and potentially gain unauthorized access to sensitive information, inject malicious code, or tamper with data. This can lead to data breaches, unauthorized system access, and compromise of the containerized environment.
There are known exploits for this vulnerability. Attackers can leverage the Man-in-the-Middle (MitM) attack to intercept and modify communication between the Docker client and server, potentially leading to unauthorized access and data compromise.
Yes, a fix is available for this vulnerability. It is recommended to update the github.com/docker/docker package to version 1.3.1 or later, which includes security patches and mitigations to prevent Man-in-the-Middle attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Gopkg.lock file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
