Vulnerability · Published Apr 6, 2023 · Assigned by Docker
CVE-2023-1802In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed
Medium 5.9
In plain English
A medium-severity security flaw in Docker Desktop from Docker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Docker | Docker Desktop | 4.17.0 – before 4.18.0 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://docs.docker.com/desktop/release-notes/#4180 release-notes
- https://github.com/docker/for-win/issues/13344 issue-tracking