Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6336-1 advisory.

    It was discovered that Docker Registry incorrectly handled certain crafted input, A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-11468)

    It was discovered that Docker Registry incorrectly handled certain crafted input. An attacker could     possibly use this issue to cause a denial of service. (CVE-2023-2253)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for docker-distribution fixes the following issues :

Security issues fixed :

  - CVE-2017-11468: Fixed a denial of service (memory     consumption) via the manifest endpoint (bsc#1049850).

Bug fixes :

  - bsc#1083474: docker-distirbution-registry overwrites     configuration file with update.

  - bsc#1033172: Garbage collector needed - or kindly     release docker-distribution-registry in Version 2.4.

  - Add SuSEfirewall2 service file for TCP port 5000.

This update was imported from the SUSE:SLE-12:Update update project.

An update for docker-distribution is now available for Red Hat Enterprise Linux 7 Extras.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The docker-distribution package provides the tool set to support the Docker Registry version 2.

The following packages have been upgraded to a later upstream version:
docker-distribution (2.6.2). (BZ#1479494)

Security Fix(es) :

* It was found that docker-distribution did not properly restrict memory allocation size for a registry instance through the manifest endpoint. An attacker could send a specially crafted request that would exhaust the memory of the docker-distribution service.
(CVE-2017-11468)

ID	Name	Product	Family	Severity
180473	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 : Docker Registry vulnerabilities (USN-6336-1)	Nessus	Ubuntu Local Security Checks	critical
108860	openSUSE Security Update : docker-distribution (openSUSE-2018-336)	Nessus	SuSE Local Security Checks	high
103039	RHEL 7 : docker-distribution (RHSA-2017:2603)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2017-11468

high

Tenable Plugins

critical

high

high