CVE-2024-3624: Mirror-registry: database user and password stored in plain-text
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
Other sources
The Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file, leaving the possibility of an malicious actor with access to this file to gain access to Quay's database.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3624?
CVE-2024-3624 is a critical vulnerability that exposes sensitive database information due to insecure plain-text storage.
How do I fix CVE-2024-3624?
To fix CVE-2024-3624, secure the configuration files by encrypting sensitive data and restrict access to the mirror-registry's config.yaml.
Who is affected by CVE-2024-3624?
CVE-2024-3624 affects users of Red Hat Quay, particularly those using the mirror-registry feature.
What kind of data is exposed by CVE-2024-3624?
CVE-2024-3624 exposes Quay's database credentials, which can lead to unauthorized database access.
What are the potential impacts of CVE-2024-3624?
The potential impacts of CVE-2024-3624 include data breaches, unauthorized access to sensitive information, and potential loss of data integrity.