CVE-2015-1843 Weak cryptography in n/a
Man-in-the-middle attackers can downgrade registry connections to HTTP, exposing authentication credentials and image data when the --add-registry option is used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1843?
CVE-2015-1843 is a medium-severity vulnerability in n/a, published on 6 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
Weakness: CWE-20
Which versions are affected by CVE-2015-1843?
It affects 1 product.
Linux distribution packages (5)
atomic Red Hat:rhel_extras_other:7 | All versions | 0:0-0.9.git4ff7dbd.el7 |
docker Red Hat:rhel_extras_other:7 | All versions | 0:1.5.0-28.el7 |
docker-logrotate Red Hat:rhel_extras_other:7 | All versions | 0:1.5.0-28.el7 |
docker-python Red Hat:rhel_extras_other:7 | All versions | 0:1.0.0-22.el7 |
python-websocket-client Red Hat:rhel_extras_other:7 | All versions | 0:0.14.1-65.el7 |
Products include Redhat Docker.
How do I fix CVE-2015-1843?
Upgrade to a fixed version.
Is CVE-2015-1843 being exploited?
There is no known exploitation of CVE-2015-1843 in the wild and no public exploit code.
Sources
Also known as GHSA-m568-g4fp-65j5, RHSA-2015:0776.