CVE-2021-41092

Name
CVE-2021-41092
Description
Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
CONFIRM https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
security-advisories@github.com https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
security-advisories@github.com https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
security-advisories@github.com https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:docker:command_line_interface:*:*:*:*:*:*:*:* command_line_interface >= None < 20.10.9

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
docker edge-community 20.10.9-r0 Jake Buchholz Göktürk <tomalok@gmail.com> fixed
docker 3.22-community 20.10.9-r0 None fixed
docker 3.21-community 20.10.9-r0 None fixed
docker 3.20-community 20.10.9-r0 None fixed
docker 3.19-community 20.10.9-r0 None fixed
docker 3.18-community 20.10.9-r0 None fixed
docker 3.17-community 20.10.9-r0 None fixed