Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.
| Vendor | Product | Versions |
|---|---|---|
| red hat | distribution | go/github.com/distribution/distribution/v3: < 3.1.0, go/github.com/distribution/distribution: <= 2.8.3 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| go | github.com/distribution/distribution | GHSA | 85% |
Updated affected versions to < 3.0.0, changed severity to CRITICAL, and noted that no exploit is available.
Initial creation
