A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies source-map-js: source-map-js: Denial of Service via malformed indexed source maps podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects pyjwt: PyJWT: Authentication bypass via improper public key validation pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling pyjwt: pyjwt: Token forgery…

Ein Angreifer kann mehrere Schwachstellen in Red Hat Quay ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.