Description
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to
create jobs/stop job tasks and retrieve job task information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Harbor | Project | <=Harbor 2.6.x, <=Harbor 2.7.2, <=Harbor 2.8.2, <=Harbor 1.10.17 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/goharbor/harbor | < 1.10.18 | 1.10.18 | GHSA-mq6f-5xh5-hgcf |
| Go | github.com/goharbor/harbor | >= 2.0.0, < 2.7.3 | 2.7.3 | GHSA-mq6f-5xh5-hgcf |
| Go | github.com/goharbor/harbor | >= 2.8.0, < 2.8.3 | 2.8.3 | GHSA-mq6f-5xh5-hgcf |
| Go | github.com/goharbor/harbor | < 1.10.18 · >= 2.0.0+incompatible, < 2.7.3+incompatible · >= 2.8.0+incompatible, < 2.8.3+incompatible | 1.10.18, 2.7.3+incompatible, 2.8.3+incompatible | GO-2023-2109 |