Bug 904165 (CVE-2014-5277) - VUL-0: CVE-2014-5277: docker: HTTP downgrade attack against registry
Summary: VUL-0: CVE-2014-5277: docker: HTTP downgrade attack against registry
Status: RESOLVED FIXED
Alias: CVE-2014-5277
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/110507/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-06 08:06 UTC by Johannes Segitz
Modified: 2015-01-26 12:01 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-11-06 08:06:43 UTC 
The Docker engine and the Python module, docker-py, first attempt  to contact the registry using HTTPS. If that attempt fails, they will fall back to using in-the-clear HTTP connections. This facilitates the possibility of a downgrade attack by allowing attackers to force registry connections into using insecure communications to transmit authentication and image data.

To avoid this vulnerability, users should upgrade to Docker 1.3.1. Users of docker-py should upgrade to version 0.5.3 or higher.

Discovered by Solomon Hykes of Docker, Inc. We would also like to credit Florian Weimer of Red Hat Product Security with independent discovery.

Already covered in 
https://build.suse.de/request/show/45873
but there was no bug open. Feel free to assign to security-team if there's nothing left to do

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5277
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5277.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5277
Comment 1 Swamp Workflow Management 2014-11-06 23:00:12 UTC 
bugbot adjusting priority
Comment 2 Flavio Castelli 2014-11-27 13:43:37 UTC 
Maintenance request submitted
Comment 3 Marcus Meissner 2014-11-27 20:48:28 UTC 
accepted and merged, thanks
Comment 4 Marcus Meissner 2015-01-26 12:01:14 UTC 
was released