Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:2154-1

Опубликовано: 09 мая 2023
Источник: suse-cvrf

Описание

Security update for distribution

This update for distribution fixes the following issues:

  • CVE-2023-2253: Fixed possible DoS via a crafted malicious /v2/_catalog API endpoint request (bsc#1207705).

Список пакетов

Container suse/registry:latest
distribution-registry-2.8.1-150400.9.18.1
SUSE Linux Enterprise Module for Containers 15 SP4
distribution-registry-2.8.1-150400.9.18.1
openSUSE Leap 15.4
distribution-registry-2.8.1-150400.9.18.1

Ссылки

Описание

A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.

Затронутые продукты
Container suse/registry:latest:distribution-registry-2.8.1-150400.9.18.1
SUSE Linux Enterprise Module for Containers 15 SP4:distribution-registry-2.8.1-150400.9.18.1
openSUSE Leap 15.4:distribution-registry-2.8.1-150400.9.18.1
Ссылки