REDHAT-BUG-2483168: Low severity Quay Quay config-tool vulnerability
The Quay config-tool's GitLab OAuth validator in pkg/lib/shared/validators.go (line 804) places clientid and clientsecret as plaintext URL querystring parameters when making POST requests to the configured GitLab endpoint. This causes credentials to leak into server access logs, reverse proxy logs, WAF logs, CDN logs, and OpenTelemetry traces even when the endpoint is the legitimate gitlab.com. The GitHub OAuth validator correctly uses HTTP Basic Auth headers and is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2483168?
The severity of REDHAT-BUG-2483168 is rated as low.
What does REDHAT-BUG-2483168 describe?
REDHAT-BUG-2483168 describes a vulnerability in the Quay config-tool where client_id and client_secret are sent as plaintext in URL query strings.
How does REDHAT-BUG-2483168 affect security?
REDHAT-BUG-2483168 affects security by leaking sensitive credentials into server and reverse proxy access logs.
What software is affected by REDHAT-BUG-2483168?
The affected software by REDHAT-BUG-2483168 is Quay and its config-tool.
How can I mitigate the risk associated with REDHAT-BUG-2483168?
To mitigate the risk of REDHAT-BUG-2483168, avoid using plaintext client_id and client_secret in query strings and adopt secure communication methods.