CVE

Id
79120  
CVE No.
CVE-2015-1843  
Status
Candidate  
Description
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.  
Phase
Assigned (20150217)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
720692 79120 CVE-2015-1843 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1206443  View
720693 79120 CVE-2015-1843 REDHAT:RHSA-2015:0776  View
720694 79120 CVE-2015-1843 URL:http://rhn.redhat.com/errata/RHSA-2015-0776.html  View
720695 79120 CVE-2015-1843 BID:73936  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
7467 JVNDB-2015-002787 IBM InfoSphere Optim Workload Replay におけるアクセス制限を回避される脆弱性 IBM InfoSphere Optim Workload Replay は、クライアント側のコードに依存して認証を検証するため、アクセス制限を回避される脆弱性が存在します。 CVE-2015-1895 79120 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002787.html  View