CVE-2020-29591: Critical severity docker registry vulnerability

Published Dec 11, 2020

Updated

Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.

Affected Software

10 affected components

Docker registry=2.5

Docker registry=2.5.0

Docker registry=2.5.0-rc

Docker registry=2.5.0-rc2

Docker registry=2.5.1

Docker registry=2.6.0

Docker registry=2.6.0-rc2

Docker registry=2.6.1

Docker registry=2.6.1-rc2

Docker registry=2.7.0

Event History

Dec 11, 2020

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

Description

Frequently Asked Questions

What is CVE-2020-29591?

CVE-2020-29591 is a vulnerability found in versions of the Official registry Docker images through 2.7.0.

What is the severity of CVE-2020-29591?

CVE-2020-29591 has a severity rating of 9.8, which is considered critical.

What is the affected software for CVE-2020-29591?

Versions 2.5, 2.5.0, 2.5.0-rc, 2.5.0-rc2, 2.5.1, 2.6.0, 2.6.0-rc2, 2.6.1, 2.6.1-rc2, and 2.7.0 of the Docker Registry are affected.

How can a remote attacker exploit CVE-2020-29591?

A remote attacker can exploit CVE-2020-29591 by using a blank password to achieve root access on systems deployed using affected versions of the Docker Registry container.

Are there any references for CVE-2020-29591?

Yes, you can find references for CVE-2020-29591 at the following links: [link1], [link2], [link3].