Description
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Docker | Docker Desktop | < 4.17.0 | 4.17.0 |
Advisories 1
- WID-SEC-2023-0636 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 13, 2023
References
- https://docs.docker.com/desktop/release-notes/#4170 release-notes