CVE-2023-1802: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
First published: Thu Apr 06 2023(Updated: )
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
Credit: security@docker.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Docker Desktop | =4.17.0 | |
| Docker Desktop | =4.17.1 |
Remedy
Update Docker Desktop to version 4.18.0
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-1802.
What is the title of the vulnerability?
The title of the vulnerability is 'In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over…'
What is the severity of CVE-2023-1802?
The severity of CVE-2023-1802 is high with a CVSS score of 7.5.
How does the vulnerability in Docker Desktop 4.17.x occur?
The vulnerability in Docker Desktop 4.17.x occurs when the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed.
Who is affected by this vulnerability in Docker Desktop 4.17.x?
Only users who have Access Experimental Features enabled and have Docker Desktop versions 4.17.0 and 4.17.1 installed on Windows are affected by this vulnerability.
How can a targeted network sniffing attack exploit this vulnerability?
A targeted network sniffing attack can exploit this vulnerability in Docker Desktop 4.17.x and lead to a disclosure of sensitive information, as the registry credentials are sent over plain HTTP.
Are there any recommended fixes or patches available to address this vulnerability?
Yes, Docker Desktop users should update to a version higher than 4.17.1 to fix this vulnerability.
Where can I find more information about CVE-2023-1802?
You can find more information about CVE-2023-1802 in the release notes of Docker Desktop 4.17.0 and the corresponding GitHub issue.
What is the Common Weakness Enumeration (CWE) ID associated with this vulnerability?
The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-319.
- collector/nvd-index
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/title
- agent/severity
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/docker
- canonical/docker desktop
- version/docker desktop/4.17.0
- version/docker desktop/4.17.1