Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Summary
Docker has fixed a critical vulnerability in Docker Hub that allowed users to push, pull, or delete images as another user. The flaw, which existed for two years, affected the feature that converts personal accounts into organizations. Docker stated that there is no evidence of the vulnerability being exploited.
IFF Assessment
This vulnerability allowed unauthorized access and manipulation of container images, posing a significant risk to the integrity and availability of software supply chains.
Severity
The vulnerability could be exploited remotely without authentication, allowing an attacker to impersonate other users and perform critical actions like pushing malicious images or deleting legitimate ones, leading to significant impact on confidentiality, integrity, and availability.
Defender Context
This incident highlights the importance of securing software registries and the potential impact of vulnerabilities that allow for image impersonation. Defenders should ensure their CI/CD pipelines are secure and that image integrity is verified to prevent the introduction of malicious code.