🔴 Critical: Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
-
A critical flaw in Docker Hub, the registry used to publish and download container images, allowed one user to push, pull, or delete images while authenticated as another user. Docker fixed the flaw on September 30 and stated that it found no evidence of exploitation in the wild.
According to a security advisory published on October 12, the issue resided in the feature that converts a personal account into an organization. The vulnerability had reportedly existed for roughly two years before being addressed.
Key points:
- Docker Hub users could potentially act on images under another user's identity due to the flaw.
- The vulnerability was tied to the personal-to-organization account conversion feature.
- Docker patched the issue on September 30.
- A security advisory was published on October 12.
- Docker says it has no evidence that the flaw was exploited.
No specific CVE ID or advisory identifier was provided in the source article. Administrators and users who rely on Docker Hub for image distribution should review the advisory and ensure their workflows align with Docker's current guidance.
Source: The Hacker News
Has your organization reviewed its Docker Hub account and organization conversion settings since this advisory was published?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login