Denial of Service in distribution-registry
ID: | SUSE-SU-2023:2298-1 | ||||||||||||
Distribution: | SUSE | ||||||||||||
Plattformen: | openSUSE Leap 15.4, SUSE Manager Proxy 4.3, SUSE Manager Server 4.3, SUSE Manager Retail Branch Server 4.3, SUSE Linux Enterprise Real Time 15 SP4, SUSE Linux Enterprise High Performance Computing 15 SP4, SUSE Linux Enterprise Server 15 SP4, SUSE Linux Enterprise Server for SAP Applications 15 SP4, Containers Module 15-SP4 | ||||||||||||
Datum: | Fr, 26. Mai 2023, 07:47 | ||||||||||||
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2253 | ||||||||||||
Applikationen: | distribution-registry | ||||||||||||
Originalnachricht |
|||||||||||||
--===============3483678310132820621== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit # Security update for distribution Announcement ID: SUSE-SU-2023:2298-1 Rating: moderate References: * #1207705 * #1210428 Cross-References: * CVE-2023-2253 CVSS scores: * CVE-2023-2253 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Containers Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability and has one fix can now be installed. ## Description: This update for distribution fixes the following issues: Update to verison 2.8.2: * Revert registry/client: set `Accept: identity` header when getting layers * Parse `http` forbidden as denied * Fix CVE-2023-2253 runaway allocation on /v2/_catalog (bsc#1207705) * Fix panic in inmemory driver * update to go1.19.9 * Add code to handle pagination of parts. Fixes max layer size of 10GB bug * Dockerfile: fix filenames of artifacts ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2298=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-2298=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * distribution-registry-2.8.2-150400.9.21.1 * Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64) * distribution-registry-2.8.2-150400.9.21.1 ## References: * https://www.suse.com/security/cve/CVE-2023-2253.html * https://bugzilla.suse.com/show_bug.cgi?id=1207705 * https://bugzilla.suse.com/show_bug.cgi?id=1210428 --===============3483678310132820621== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit |