REDHAT-BUG-2216924: XSS
The vulnerability exists in the bootbox component of the container image labels within Quay. Specifically, the bootbox title dialog is not properly sanitized.
While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry, containing a script that can be executed via XSS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2216924?
The severity of REDHAT-BUG-2216924 is considered high due to improper sanitization in the bootbox component.
How do I fix REDHAT-BUG-2216924?
To fix REDHAT-BUG-2216924, apply the latest updates and patches released by Red Hat for Quay.
What are the risks associated with REDHAT-BUG-2216924?
The risks associated with REDHAT-BUG-2216924 include potential Cross-Site Scripting (XSS) attacks due to insufficient input validation.
Which version of Red Hat Quay is affected by REDHAT-BUG-2216924?
REDHAT-BUG-2216924 affects all versions of Red Hat Quay that utilize the vulnerable bootbox component.
Is there a workaround for REDHAT-BUG-2216924?
Currently, there is no official workaround for REDHAT-BUG-2216924; it is recommended to update to the patched version.