PT-2020-17207 · Docker · Docker Registry

Published 2020-11-12 · Updated 2020-12-15 · CVE-2020-29591

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Registry versions through 2.7.0

Description The issue concerns a blank password for the root user in affected Docker Registry versions. This could allow a remote attacker to gain root access using the blank password.

Recommendations For versions through 2.7.0, update to a version that includes a fix for the blank root password issue to prevent unauthorized root access.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2020-29591

Affected Products

Docker Registry

References · 16

• 🔥❌ https://github.com/donghyunlee00/CVE/blob/main/CVE-2020-29591 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-29591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29591 · Security Note
• https://github.com/docker/distribution-library-image · Note
• https://t.me/cibsecurity/20371 · Telegram Post
• https://t.me/cibsecurity/20390 · Telegram Post
• https://hub.docker.com/_/registry · Note
• https://t.me/cibsecurity/20428 · Telegram Post
• https://t.me/cibsecurity/20341 · Telegram Post
• https://t.me/cibsecurity/20263 · Telegram Post
• https://t.me/cibsecurity/20302 · Telegram Post
• https://t.me/cibsecurity/20283 · Telegram Post
• https://t.me/cibsecurity/20448 · Telegram Post
• https://t.me/cibsecurity/20351 · Telegram Post
• https://t.me/cibsecurity/20408 · Telegram Post