Information Exposure Through Log Files Affecting docker.io package, versions <18.09.1+dfsg1-8


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    5.64% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-DOCKERIO-525811
  • published 24 Jul 2019
  • disclosed 18 Jul 2019

How to fix?

Upgrade Debian:11 docker.io to version 18.09.1+dfsg1-8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream docker.io package and not the docker.io package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.