Skip to content
OpenAdvisories
Medium USN-5134-1 1 CVE

docker.io vulnerability

Published Nov 9, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

An information disclosure issue was discovered in the command line interface
of Docker. A misconfigured credential store could result in supplied
credentials being leaked to the public registry, when using the docker login
command with a private registry.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS docker.io 20.10.7-0ubuntu5~18.04.3
Ubuntu · 20.04 LTS 20.04:LTS docker.io 20.10.7-0ubuntu5~20.04.2

Vulnerabilities 1

  • Medium 5.4
    CVE-2021-41092

    Docker CLI leaks private registry credentials to registry-1.docker.io

    Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `cr…

    Docker cli docker.io dive Debian Ubuntu Alpine Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2021-41092