Описание
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Отчет
Exploitation requires valid login credentials. The attacker must be authenticated to the registry, either through the web interface or through a container tool such as Podman.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| mirror registry for Red Hat OpenShift | openshift/mirror-registry-rhel8 | Will not fix | ||
| mirror registry for Red Hat OpenShift 2.0 | openshift/mirror-registry-rhel8 | Fixed | RHSA-2026:28441 | 23.06.2026 |
| Red Hat Quay 3.1 | quay/quay-rhel8 | Fixed | RHSA-2026:22840 | 03.06.2026 |
| Red Hat Quay 3.12 | quay/quay-rhel8 | Fixed | RHSA-2026:22629 | 02.06.2026 |
| Red Hat Quay 3.14 | quay/quay-rhel8 | Fixed | RHSA-2026:21017 | 26.05.2026 |
| Red Hat Quay 3.15 | quay/quay-rhel8 | Fixed | RHSA-2026:24853 | 09.06.2026 |
| Red Hat Quay 3.16 | quay/quay-rhel9 | Fixed | RHSA-2026:19375 | 19.05.2026 |
| Red Hat Quay 3.17 | quay/quay-rhel9 | Fixed | RHSA-2026:22465 | 02.06.2026 |
| Red Hat Quay 3.17 | quay/quay-rhel9 | Fixed | RHSA-2026:24833 | 09.06.2026 |
| Red Hat Quay 3.18 | quay/quay-rhel9 | Fixed | RHSA-2026:48085 | 29.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
EPSS
7.1 High
CVSS3