[Bug 1474893] New: CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
10:10 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Bug ID: 1474893
Summary: CVE-2017-11468 docker-distribution: Does not properly
restrict the amount of content accepted from a user
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: admiller(a)redhat.com, fkluknav(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com, lsm5(a)redhat.com,
marianne(a)tuxette.fr
Docker Registry in Docker Distribution does not properly restrict the amount of
content accepted from a user, which allows remote attackers to cause a denial
of service (memory consumption) via the manifest endpoint.
Upstream patch:
https://github.com/docker/distribution/commit/29fa466debaabb64f8559116bbf...
References:
https://github.com/docker/distribution/releases/tag/v2.6.2
--
You are receiving this mail because:
You are on the CC list for the bug.
10:10 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1474894
--- Comment #1 from Andrej Nemec <anemec(a)redhat.com> ---
Created docker-distribution tracking bugs for this issue:
Affects: fedora-all [bug 1474894]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1474894
[Bug 1474894] CVE-2017-11468 docker-distribution: Does not properly
restrict the amount of content accepted from a user [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
10:12 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1474896
--
You are receiving this mail because:
You are on the CC list for the bug.
10:13 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart <cbuissar(a)redhat.com> ---
It was found that docker-distribution did not properly restrict memory allocation size for
a registry instance through the manifest endpoint. An authenticated attacker could upload
a specially crafted image that would exhaust the memory of a docker host.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:14 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0707,reported=20170719,sour |0707,reported=20170719,sour
|ce=cve,cvss3=7.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/
|I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora-
|all/docker-distribution=aff |all/docker-distribution=aff
|ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib
|ution=new,rhel-7/kubernetes |ution=new,rhel-7/kubernetes
|=new |=new
--
You are receiving this mail because:
You are on the CC list for the bug.
10:45 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0707,reported=20170719,sour |0707,reported=20170719,sour
|ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/
|I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora-
|all/docker-distribution=aff |all/docker-distribution=aff
|ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib
|ution=new,rhel-7/kubernetes |ution=affected,rhel-7/kuber
|=new |netes=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
3:19 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0707,reported=20170719,sour |0707,reported=20170719,sour
|ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/
|I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora-
|all/docker-distribution=aff |all/docker-distribution=aff
|ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib
|ution=affected,rhel-7/kuber |ution=affected,rhel-7/kuber
|netes=affected |netes=new
--
You are receiving this mail because:
You are on the CC list for the bug.
3:36 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0707,reported=20170719,sour |0707,reported=20170719,sour
|ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:R/S:U/C:N/ |V:N/AC:L/PR:N/UI:R/S:U/C:N/
|I:N/A:H,cwe=CWE-770,fedora- |I:N/A:H,cwe=CWE-770,fedora-
|all/docker-distribution=aff |all/docker-distribution=aff
|ected,rhel-7/docker-distrib |ected,rhel-7/docker-distrib
|ution=affected,rhel-7/kuber |ution=affected,rhel-7/kuber
|netes=new |netes=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
3:43 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1479705, 1479706
--
You are receiving this mail because:
You are on the CC list for the bug.
10:32 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart <cbuissar(a)redhat.com> ---
It was found that docker-distribution did not properly restrict memory allocation size for
a registry instance through the manifest endpoint. An authenticated attacker could send a
specially crafted request that would exhaust the memory of the docker-distribution
service.
--
You are receiving this mail because:
You are on the CC list for the bug.
4:26 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|medium |low
Whiteboard|impact=moderate,public=2017 |impact=low,public=20170707,
|0707,reported=20170719,sour |reported=20170719,source=cv
|ce=cve,cvss3=6.5/CVSS:3.0/A |e,cvss3=5.3/CVSS:3.0/AV:N/A
|V:N/AC:L/PR:N/UI:R/S:U/C:N/ |C:L/PR:N/UI:N/S:U/C:N/I:N/A
|I:N/A:H,cwe=CWE-770,fedora- |:L,cwe=CWE-770,fedora-all/d
|all/docker-distribution=aff |ocker-distribution=affected
|ected,rhel-7/docker-distrib |,rhel-7/docker-distribution
|ution=affected,rhel-7/kuber |=affected,rhel-7/kubernetes
|netes=notaffected |=notaffected
Severity|medium |low
--
You are receiving this mail because:
You are on the CC list for the bug.
4:33 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Doc Text *updated* by Cedric Buissart <cbuissar(a)redhat.com> ---
It was found that docker-distribution did not properly restrict memory allocation size for
a registry instance through the manifest endpoint. An attacker could send a specially
crafted request that would exhaust the memory of the docker-distribution service.
--
You are receiving this mail because:
You are on the CC list for the bug.
5:38 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
--- Comment #4 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Extras
Via RHSA-2017:2603 https://access.redhat.com/errata/RHSA-2017:2603
--
You are receiving this mail because:
You are on the CC list for the bug.
7:29 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2017-09-05 08:29:58
--
You are receiving this mail because:
You are on the CC list for the bug.
12:24 p.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the
amount of content accepted from a user [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |EOL
--
You are receiving this mail because:
You are on the CC list for the bug.
12:46 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the
amount of content accepted from a user [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |NEW
Resolution|EOL |---
--
You are receiving this mail because:
You are on the CC list for the bug.
9:58 a.m.
New subject: [Bug 1474893] CVE-2017-11468 docker-distribution: Does not properly restrict the amount of content accepted from a user
https://bugzilla.redhat.com/show_bug.cgi?id=1474893
Bug 1474893 depends on bug 1474894, which changed state.
Bug 1474894 Summary: CVE-2017-11468 docker-distribution: Does not properly restrict the
amount of content accepted from a user [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1474894
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |CURRENTRELEASE
--
You are receiving this mail because:
You are on the CC list for the bug.
1979
days inactive
2468
days old
golang-updates@lists.fedoraproject.org
16 comments
1 participants
participants (1)
-
bugzilla＠redhat.com