Summary
It was discovered that Docker Registry incorrectly handled certain crafted
input, A remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11468)
It was discovered that Docker Registry incorrectly handled certain crafted
input. An attacker could possibly use this issue to cause a denial of
service. (CVE-2023-2253)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | docker-registry | 2.7.1+ds2-7ubuntu0.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | docker-registry | 2.3.0~ds1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | docker-registry | 2.6.2~ds1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | docker-registry | 2.8.0+ds1-4ubuntu0.1~esm2 |
Vulnerabilities 2
-
High 7.5
Docker Registry has Allocation of Resources Without Limits or Throttling
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
-
Medium 6.5
distribution catalog API endpoint can lead to OOM via malicious user input
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for…