REDHAT-BUG-2547765: Medium severity Katello Katello vulnerability
A flaw was found in Katello. The Docker Tags repositories API endpoint resolves a DockerMetaTag with an unscoped find and returns associated repositories without intersecting Repository.readable. An authenticated user with viewproducts permission in one organization can enumerate repository metadata (names, product associations, content types, upstream URLs) for Docker tags belonging to other organizations by supplying the tag identifier and omitting the optional organization filter. Reported via PSIRTSUPT-25120.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has the view_products permission in at least one organization can exploit it. The user does not need access to the organization whose Docker tag repository metadata is exposed.
What does an attacker need to do to access metadata from another organization?
The attacker must supply the identifier of a Docker tag belonging to another organization and omit the optional organization filter when calling the Docker Tags repositories API endpoint.
What information can be exposed?
The endpoint can disclose associated repository metadata, including repository names, product associations, content types, and upstream URLs.