x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-8w94-cf6g-c8mg

[julieqiu]

In GitHub Security Advisory GHSA-8w94-cf6g-c8mg, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/docker/docker	1.3.1	< 1.3.1

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/docker/docker
    versions:
      - fixed: 1.3.1
description: Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when
    the HTTPS connection to the registry fails, which allows man-in-the-middle attackers
    to conduct downgrade attacks and obtain authentication and image data by leveraging
    a network position between the client and the registry to block HTTPS traffic.
published: 2022-02-15T01:57:18Z
last_modified: 2022-04-12T22:53:42Z
cves:
  - CVE-2014-5277
ghsas:
  - GHSA-8w94-cf6g-c8mg
links:
    context:
      - https://github.com/advisories/GHSA-8w94-cf6g-c8mg

[julieqiu]

Vulnerability in tool. Not importable.

[gopherbot]

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607222 mentions this issue: data/reports: unexclude 20 reports (20)