Skip to content
OpenAdvisories
High WID-SEC-2024-0977 4 CVEs

Red Hat Quay: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Apr 25, 2024 · Updated Apr 25, 2024 · de-DE

Vendor: Red Hat Product: quay

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Quay ausnutzen, um Informationen offenzulegen.

Product

Red Hat Quay ist eine verteilte und hochverfügbare Container Image Registry.

Vulnerabilities 4

  • High 8.8
    CVE-2024-3622

    Mirror-registry: plain-text default csrf secret key

    A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the sam…

    Red Hat mirror registry for Red Hat OpenShift
  • High 7.3
    CVE-2024-3624

    Mirror-registry: database user and password stored in plain-text

    A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.

    Red Hat mirror registry for Red Hat OpenShift
  • High 7.3
    CVE-2024-3625

    Mirror-registry: redis password stored in plain-text

    A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.

    Red Hat mirror registry for Red Hat OpenShift
  • Medium 6.5
    CVE-2024-3623

    Mirror-registry: default database secret key stored in plain-text on initial configuration file

    A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to…

    Red Hat mirror registry for Red Hat OpenShift

Revision history

  1. #1

    Initiale Fassung

References