Docker Desktop Sensitive Information Disclosure Vulnerability

A vulnerability in Docker Desktop prior to version 4.39.0 allows for the unintended disclosure of sensitive information through application logs. When an HTTP GET request was made via a proxy, proxy configuration data, potentially containing sensitive details, was logged in clear text. An attacker with access to these logs could extract the proxy information and use it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, mitigating this risk.

Impact

Exploitation of this vulnerability could lead to unauthorized access or further attacks using extracted proxy information.

Remediation

Users can update to Docker Desktop version 4.39.0 or later, where this vulnerability has been addressed.