A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| advanced cluster security | 4.4 | — | |
| advanced cluster security | 4.5 | — | |
| container native virtualization | 4.15 | — | |
| enterprise linux | 8 | — | |
| enterprise linux | 9 | — | |
| openshift | 4.13 | — | |
| openshift | 4.14 | — | |
| openshift | 4.15 | — | |
| openshift | 4.16 | — | |
| openshift | 4.17 | — | |
| openshift | 4.18 | — | |
| openshift api data protection | 1.3 | — | |
| openshift ironic | 4.13 | — | |
| openshift ironic | 4.14 | — | |
| openshift ironic | 4.15 | — | |
| openshift ironic | 4.16 | — | |
| Red Hat | OADP-1.3-RHEL-9 | all versions | |
| Red Hat | Red Hat Advanced Cluster Security 4.4 | all versions | |
| Red Hat | Red Hat Advanced Cluster Security 4.5 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Migration Toolkit for Containers 1.8 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | all versions | |
| rhmt | 1.8 | — | |
| — | image | < 5.29.3, 5.30.0 – < 5.30.1 |
Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.
