From 95fed9774b48b7bc393faf071843714f094807ce Mon Sep 17 00:00:00 2001 From: Bruno Sousa <107440821+bsousaa@users.noreply.github.com> Date: Wed, 30 Apr 2025 11:53:28 +0100 Subject: [PATCH] Add CVE-2025-4095 to release notes of Docker Desktop 4.41 (#22521) ## Description Add CVE-2025-4095 to release notes of Docker Desktop 4.41 ## Related issues or tickets ## Reviews - [ ] Technical review - [ ] Editorial review - [ ] Product review Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com> --- content/manuals/desktop/release-notes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/manuals/desktop/release-notes.md b/content/manuals/desktop/release-notes.md index 5e0114aa26..46534cf4ec 100644 --- a/content/manuals/desktop/release-notes.md +++ b/content/manuals/desktop/release-notes.md @@ -54,6 +54,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo ### Security - Fixed [CVE-2025-3224](https://www.cve.org/CVERecord?id=CVE-2025-3224) allowing an attacker with access to a user machine to perform an elevation of privilege when Docker Desktop updates. +- Fixed [CVE-2025-4095](https://www.cve.org/CVERecord?id=CVE-2025-4095) where Registry Access Management (RAM) policies were not enforced when using a MacOS configuration profile, allowing users to pull images from unapproved registries. - Fixed [CVE-2025-3911](https://www.cve.org/CVERecord?id=CVE-2025-3911) allowing an attacker with read access to a user's machine to obtain sensitive information from Docker Desktop log files, including environment variables configured for running containers. ### Bug fixes and enhancements