VDB
Sign up
MEDIUM5.4

GHSA-99pg-grm5-qq3v

Docker CLI leaks private registry credentials to registry-1.docker.io

Quick fix

GHSA-99pg-grm5-qq3v — github.com/docker/cli: upgrade to the fixed version with the command below.

go get github.com/docker/cli@v20.10.9

Details

## Impact

A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry.

## Patches

This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible.

## Workarounds

Ensure that any configured `credsStore` or `credHelpers` entries in the configuration file reference an installed credential helper that is executable and on the `PATH`.

## For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/docker/cli/issues/new/choose) * Email us at security@docker.com if you think you’ve found a security bug

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/docker/cli
Introduced in: 0Fixed in: 20.10.9
Fixgo get github.com/docker/cli@v20.10.9

References