REDHAT-BUG-2455571: High severity Docker Distribution vulnerability
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
distributionto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455571?
The severity of REDHAT-BUG-2455571 is high, rated at 7.
What are the potential risks of REDHAT-BUG-2455571?
The potential risks of REDHAT-BUG-2455571 include unauthorized read access to deleted repository content.
How do I fix REDHAT-BUG-2455571?
To fix REDHAT-BUG-2455571, update to Docker Distribution version 3.1.0 or later, where the vulnerability has been addressed.
What versions of Docker Distribution are affected by REDHAT-BUG-2455571?
Docker Distribution versions prior to 3.1.0 are affected by REDHAT-BUG-2455571.
What configurations could lead to the vulnerability in REDHAT-BUG-2455571?
The vulnerability in REDHAT-BUG-2455571 occurs when both storage.cache.blobdescriptor: redis and storage.delete.enabled: true are enabled.