CVE-2021-41092

Aliases:GHSA-99pg-grm5-qq3vGO-2024-2912BIT-docker-cli-2021-41092
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 04 Oct 2021, 20:10
Last modified:04 Aug 2024, 02:59

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.08% LOW
0% probability -0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Oct 2021, 20:10
Published
Vulnerability first disclosed
04 Aug 2024, 02:59
Last Modified
Vulnerability information updated

Description

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.08%• Percentile: 23%

Techniques & Countermeasures

  • CWE-522•Insufficiently Protected Credentials

    The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • docker•cli

    < 20.10.9

  • docker•command_line_interface

    < 20.10.9

  • fedoraproject•fedora

    34 | 35

  • github.com/docker•cli

    < 20.10.9+incompatible | < 20.10.9

References (8)