PT-2025-9918 · Docker · Docker Desktop

Publicado 2025-03-06 · Atualizado 2025-03-07 · CVE-2025-1696

Positive Technologies (AI Summary)

CVSS v4.0

5.2

Média

Vetor base

AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Docker Desktop versions prior to 4.39.0

Description A vulnerability exists that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access.

Recommendations For versions prior to 4.39.0, update to version 4.39.0 or later to mitigate the risk of sensitive information disclosure.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2025-1696

Produtos afetados

Docker Desktop

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-1696 · Nota de Segurança
• https://twitter.com/CVEnew/status/1897912304093872220 · Publicação no Twitter
• https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs · Nota
• https://docs.docker.com/desktop/settings-and-maintenance/settings/#proxies · Nota