Information disclosure in Docker Cli
CVE-2021-41092
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
Vulnerability class: Information Disclosure
EPSS: 0.017 (74.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Docker Cli — versions < 20.10.9
- Docker Command_line_interface
- Fedoraproject Fedora — versions 34, 35
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
- security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2021-41092?
- CVE-2021-41092 is a medium-severity vulnerability in Docker Cli, classified under Information Disclosure. CVSS score: 5.4/10. Published 2021-10-04.
- How severe is CVE-2021-41092?
- Medium severity. CVSS v3 base score is 5.4 out of 10.