Red Hat Quay 3.0.0

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

Mirror-registry: remote code execution using pickle deserialization

Quay: unauthenticated secscan notification endpoint in quay when psk is unset

Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Quay: unauthenticated exported logs download in quay

Quay: stripe webhook accepts forged events without signature verification in quay

Mirror-registry: quay: insecure direct object reference in blobupload

Quay: ssrf via build archive_url in quay build api

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

Quay: clickjacking on config-editor page severity

Mirror-registry: quay: quay: server-side request forgery via log export functionality

Quay: cross-site request forgery (csrf) on config-editor page

Quay: ldap referral filter injection in quay external ldap authentication

A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.

Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

Quay: stored cross site scripting

Quay: jwt claim validation bypasses in quay federated robot and sso authentication

Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

Quay: quay allows successful authentication with trucated version of the password

Quay: repository notification uuid idor in quay api

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.

Quay: unauthorized user may authenticate via oauth application token