Threats tagged 'ghsa-hrf4-3f42-8mh7'

Docker Desktop versions prior to 4.94.0 could log the signed-in user's Docker Hub access token (JWT) in cleartext within application logs and diagnostic bundles. This occurred because IPC payloads that were bare JSON strings or arrays were not redacted before logging, allowing a component to log the token when requesting it from the backend. An attacker with read access to these logs could obtain the token and use it to access and modify the user's Docker Hub data while the token remains valid. Version 4.94.0 of Docker Desktop introduces redaction of these payloads to prevent token exposure. However, logs created by earlier versions are not rewritten and may still contain tokens after upgrading.