DEBIAN-CVE-2021-41092

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2021-41092
Published: 04 Oct 2021, 20:15
Last modified:28 Apr 2026, 20:22

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Oct 2021, 20:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:22
Last Modified
Vulnerability information updated

Description

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Systems

  • debian•docker.io

    < 20.10.5+dfsg1-1+deb11u1 | < 20.10.10+dfsg1-1 | < 20.10.10+dfsg1-1 | < 20.10.10+dfsg1-1

References (1)