In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

CVE-2023-1802

What is CVE-2023-1802?

In Docker Desktop version 4.17.x, a vulnerability exists in the Artifactory Integration where registry credentials may be sent over unencrypted HTTP instead of HTTPS if the HTTPS health check fails. This flaw primarily affects users with Access Experimental Features enabled who are logged into a private registry, making them potentially susceptible to targeted network sniffing attacks that could lead to the exposure of sensitive information.

References