REDHAT-BUG-2516142: Path Traversal
A flaw was found in Red Hat Quay's security scanner notification endpoint. When SECURITYSCANNERV4PSK is unset (the default configuration), the /secscan/notification endpoint at endpoints/secscan.py accepts anonymous POST requests with no authentication. An attacker can flood the secscan notification queue and inject notificationid values containing path traversal characters into Clair API URL paths. The impact is worker resource exhaustion and blind path manipulation on the configured Clair host. Operator-managed deployments auto-generate the PSK, limiting exposure to standalone installations that have not explicitly configured the pre-shared key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In operator-managed deployments and especially in standalone installations, explicitly configure SECURITY_SCANNER_V4_PSK so that the /secscan/notification endpoint at endpoints/secscan.py no longer accepts anonymous POST requests when SECURITY_SCANNER_V4_PSK is unset.
Red Hat Quay (secscan notification endpoint) SECURITY_SCANNER_V4_PSK = set to a non-empty pre-shared key - Compensating control
Restrict network access to the /secscan/notification endpoint (endpoints/secscan.py) so only trusted sources can reach it, to reduce the ability to flood the secscan notification queue.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2516142?
The severity of REDHAT-BUG-2516142 is categorized as medium with a score of 4.
How do I fix REDHAT-BUG-2516142?
To fix REDHAT-BUG-2516142, set SECURITY_SCANNER_V4_PSK to a value to avoid anonymous POST requests.
What vulnerability type is associated with REDHAT-BUG-2516142?
REDHAT-BUG-2516142 is associated with a Path Traversal vulnerability.
What impact does REDHAT-BUG-2516142 have on Red Hat Quay?
REDHAT-BUG-2516142 allows an attacker to flood the security scanner notification endpoint with unauthenticated requests.
Is REDHAT-BUG-2516142 applicable to all versions of Red Hat Quay?
The vulnerability REDHAT-BUG-2516142 affects versions of Red Hat Quay that use the default configuration for the security scanner.