In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: Docker

Published: 2023-04-06T08:52:19.506Z

Updated: 2024-08-02T06:05:26.143Z

Reserved: 2023-04-03T10:20:15.739Z

Link: CVE-2023-1802

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-04-06T09:15:07.030

Modified: 2024-11-21T07:39:56.090

Link: CVE-2023-1802

cve-icon Redhat

No data.