GO-2021-0072

vendorUSosv

Uncontrolled resource allocation in github.com/docker/distribution

view advisory published 2021-04-14Licence: per source

Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-11468US	high7.5	3.19% (88th)	—	2017-07-20
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of servic…

references

External citations — patches, advisories, analysis.

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00047.htmlWEB
https://access.redhat.com/errata/RHSA-2017:2603WEB
https://github.com/distribution/distribution/commit/91c507a39abfce14b5c8541cf284330e22208c0fFIX
https://github.com/distribution/distribution/pull/2340FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan