PT-2025-9918 · Docker · Docker Desktop

Published 2025-03-06 · Updated 2025-03-07 · CVE-2025-1696

Positive Technologies (AI Summary)

CVSS v4.0

5.2

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Docker Desktop versions prior to 4.39.0

Description A vulnerability exists that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access.

Recommendations For versions prior to 4.39.0, update to version 4.39.0 or later to mitigate the risk of sensitive information disclosure.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-1696

Affected Products

Docker Desktop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-1696 · Security Note
• https://twitter.com/CVEnew/status/1897912304093872220 · Twitter Post
• https://docs.docker.com/desktop/troubleshoot-and-support/troubleshoot/#check-the-logs · Note
• https://docs.docker.com/desktop/settings-and-maintenance/settings/#proxies · Note