Description
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Docker | Docker Desktop | 4.17.0 – < 4.18.0 | 4.18.0 |
Advisories 1
- WID-SEC-2023-0882 docker Desktop: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 5, 2023
References
- https://docs.docker.com/desktop/release-notes/#4180 release-notes
- https://github.com/docker/for-win/issues/13344 issue-tracking