https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Bug ID: 1474893 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: admiller@redhat.com, fkluknav@redhat.com, golang-updates@lists.fedoraproject.org, jchaloup@redhat.com, lsm5@redhat.com, marianne@tuxette.fr
Docker Registry in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
Upstream patch:
https://github.com/docker/distribution/commit/29fa466debaabb64f8559116bbffd2...
References:
https://github.com/docker/distribution/releases/tag/v2.6.2
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1474894
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Created docker-distribution tracking bugs for this issue:
Affects: fedora-all [bug 1474894]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1474894 [Bug 1474894] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1474896
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart cbuissar@redhat.com --- It was found that docker-distribution did not properly restrict memory allocation size for a registry instance through the manifest endpoint. An authenticated attacker could upload a specially crafted image that would exhaust the memory of a docker host.
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0707,reported=20170719,sour |0707,reported=20170719,sour |ce=cve,cvss3=7.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora- |all/docker-distribution=aff |all/docker-distribution=aff |ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib |ution=new,rhel-7/kubernetes |ution=new,rhel-7/kubernetes |=new |=new
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0707,reported=20170719,sour |0707,reported=20170719,sour |ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora- |all/docker-distribution=aff |all/docker-distribution=aff |ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib |ution=new,rhel-7/kubernetes |ution=affected,rhel-7/kuber |=new |netes=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0707,reported=20170719,sour |0707,reported=20170719,sour |ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora- |all/docker-distribution=aff |all/docker-distribution=aff |ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib |ution=affected,rhel-7/kuber |ution=affected,rhel-7/kuber |netes=affected |netes=new
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0707,reported=20170719,sour |0707,reported=20170719,sour |ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora- |all/docker-distribution=aff |all/docker-distribution=aff |ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib |ution=affected,rhel-7/kuber |ution=affected,rhel-7/kuber |netes=new |netes=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1479705, 1479706
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart cbuissar@redhat.com --- It was found that docker-distribution did not properly restrict memory allocation size for a registry instance through the manifest endpoint. An authenticated attacker could send a specially crafted request that would exhaust the memory of the docker-distribution service.
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Whiteboard|impact=moderate,public=2017 |impact=low,public=20170707, |0707,reported=20170719,sour |reported=20170719,source=cv |ce=cve,cvss3=6.5/CVSS:3.0/A |e,cvss3=5.3/CVSS:3.0/AV:N/A |V:N/AC:L/PR:N/UI:R/S:U/C:N/ |C:L/PR:N/UI:N/S:U/C:N/I:N/A |I:N/A:H,cwe=CWE-770,fedora- |:L,cwe=CWE-770,fedora-all/d |all/docker-distribution=aff |ocker-distribution=affected |ected,rhel-7/docker-distrib |,rhel-7/docker-distribution |ution=affected,rhel-7/kuber |=affected,rhel-7/kubernetes |netes=notaffected |=notaffected Severity|medium |low
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart cbuissar@redhat.com --- It was found that docker-distribution did not properly restrict memory allocation size for a registry instance through the manifest endpoint. An attacker could send a specially crafted request that would exhaust the memory of the docker-distribution service.
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Extras
Via RHSA-2017:2603 https://access.redhat.com/errata/RHSA-2017:2603
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2017-09-05 08:29:58
https://bugzilla.redhat.com/show_bug.cgi?id=1474893 Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1474893 Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|EOL |---
https://bugzilla.redhat.com/show_bug.cgi?id=1474893 Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |CURRENTRELEASE
golang-updates@lists.fedoraproject.org