Containerised software darling Docker has revealed a brief security incident.
The event, which took place last Friday Australian time, saw “a brief period of unauthorised access” to the Docker Hub repository of container images.
Docker has warned that “some sensitive data from approximately 190,000 accounts may have been exposed” with “usernames and hashed passwords for a small percentage of users as well as GitHub and Bitbucket tokens for Docker autobuilds” exposed.
The company has revoked all access token to the relevant accounts and required a password reset for all potentially-affected users.
As Docker Hub links to GitHub, tokens for the latter service were also revoked without users being told in advance even though that broke autobuilds. Docker almost-apologised for doing so, saying it was necessary to preserve security.
Docker has not, however, explained the source of the incident. CRN’s best guess is that someone got their hands on credentials to a privileged account. Which probably means someone fell for phish. Sigh.
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
