Mirror-registry: remote code execution using pickle deserialization
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
mirror registry for Red Hat OpenShift 2.0
Vendor
Red Hat
Product
mirror registry for Red Hat OpenShift 2.0
Platforms
Unknown
Default status
affected
Package
openshift/mirror-registry-rhel8
Package collection
https://catalog.redhat.com/software/containers/
mirror registry for Red Hat OpenShift 2.0 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1782177012
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.10
Vendor
Red Hat
Product
Red Hat Quay 3.10
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel8
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.10 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1779822261
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.12
Vendor
Red Hat
Product
Red Hat Quay 3.12
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel8
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.12 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1779811412
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.14
Vendor
Red Hat
Product
Red Hat Quay 3.14
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel8
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.14 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1779689392
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.15
Vendor
Red Hat
Product
Red Hat Quay 3.15
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel8
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1780891395
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.16
Vendor
Red Hat
Product
Red Hat Quay 3.16
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.16 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1779204086
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.17
Vendor
Red Hat
Product
Red Hat Quay 3.17
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.17 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1779922205
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.17
Vendor
Red Hat
Product
Red Hat Quay 3.17
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.17 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1780604033
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.18
Vendor
Red Hat
Product
Red Hat Quay 3.18
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.18 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1784987273
unaffected
rpm
*
Unavailable
None listed
Red Hat Quay 3.9
Vendor
Red Hat
Product
Red Hat Quay 3.9
Platforms
Unknown
Default status
affected
Package
quay/quay-rhel8
Package collection
https://catalog.redhat.com/software/containers/
Red Hat Quay 3.9 · Scoped product and version facts