Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-29662 BIT-harbor-2020-29662EUVD-2022-0783GHSA-38r5-34mr-mvm7GO-2022-0785

"catalog's registry v2 api exposed on unauthenticated path in Harbor"

Published Feb 2, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: github.com/goharbor/harbor Ecosystem: Go

Description

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/goharbor/harbor < 2.0.5 2.0.5 GHSA-38r5-34mr-mvm7
Go github.com/goharbor/harbor >= 2.1.0, < 2.1.2 2.1.2 GHSA-38r5-34mr-mvm7
Go github.com/goharbor/harbor < 2.0.5+incompatible · >= 2.1.0+incompatible, < 2.1.2+incompatible 2.0.5+incompatible, 2.1.2+incompatible GO-2022-0785

References