CVE-2024-3623: Mirror-registry: default database secret key stored in plain-text on initial configuration file
A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay's database.
Other sources
The default DATABASESECRETKEY field is stored in plain text on the jinja's config.yaml file, leaving the possibility of every mirror-registry installation which hasn't changed ot to have the same DATABASESECRETKEY.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3623?
CVE-2024-3623 is considered a high-severity vulnerability due to the exposure of a default database secret key in plain text.
How do I fix CVE-2024-3623?
To fix CVE-2024-3623, you should update your Quay and mirror-registry configurations to use a secure, unique database secret key instead of the default.
Who is affected by CVE-2024-3623?
CVE-2024-3623 affects instances of Red Hat Quay and Red Hat mirror-registry that utilize the default database secret key.
What are the potential impacts of CVE-2024-3623?
The primary impact of CVE-2024-3623 is that it can lead to data exposure and unauthorized access to databases across multiple Quay instances.
Is there a workaround for CVE-2024-3623?
While the best solution is to update the database secret key, a temporary workaround is to restrict access to the affected configuration files.