PT-2021-7301 · Docker+5 · Docker Cli+5
Lowthajeztah
·
Published
2021-10-04
·
Updated
2026-02-06
·
CVE-2021-41092
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Docker CLI versions prior to 20.10.9
Description
A bug was found in the Docker CLI where running
docker login my-private-registry.example.com with a misconfigured configuration file (typically ~/.docker/config.json) listing a credsStore or credHelpers that could not be executed would result in any provided credentials being sent to registry-1.docker.io rather than the intended private registry. The issue is related to insufficient protection of registration data, which could allow a remote attacker to obtain arbitrary credentials.Recommendations
For Docker CLI versions prior to 20.10.9, update to version 20.10.9 as soon as possible.
For users unable to update, ensure that any configured
credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.Fix
Information Disclosure
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Docker Cli
Linuxmint
Suse
Ubuntu