Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2017-2274:01 advisory.

    * It was found that docker-distribution did not properly restrict memory     allocation size for a registry instance through the manifest endpoint. An     attacker could send a specially crafted request that would exhaust the memory of     the docker-distribution service. (CVE-2017-11468)     CVE-2017-11468     Docker Registry before 2.6.2 in Docker Distribution does not properly     restrict the amount of content accepted from a user, which allows     remote attackers to cause a denial of service (memory consumption) via     the manifest endpoint.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6336-1 advisory.

    It was discovered that Docker Registry incorrectly handled certain crafted input, A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-11468)

    It was discovered that Docker Registry incorrectly handled certain crafted input. An attacker could     possibly use this issue to cause a denial of service. (CVE-2023-2253)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for docker-distribution fixes the following issues :

Security issues fixed :

  - CVE-2017-11468: Fixed a denial of service (memory     consumption) via the manifest endpoint (bsc#1049850).

Bug fixes :

  - bsc#1083474: docker-distirbution-registry overwrites     configuration file with update.

  - bsc#1033172: Garbage collector needed - or kindly     release docker-distribution-registry in Version 2.4.

  - Add SuSEfirewall2 service file for TCP port 5000.

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:2603 advisory.

    The docker-distribution package provides the tool set to support the Docker Registry version 2.

    The following packages have been upgraded to a later upstream version: docker-distribution (2.6.2).
    (BZ#1479494)

    Security Fix(es):

    * It was found that docker-distribution did not properly restrict memory allocation size for a registry     instance through the manifest endpoint. An attacker could send a specially crafted request that would     exhaust the memory of the docker-distribution service. (CVE-2017-11468)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
289607	MiracleLinux 7 : docker-distribution-2.6.2-1.git48294d9.el7 (AXSA:2017-2274:01)	Nessus	Miracle Linux Local Security Checks	high
180473	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 : Docker Registry vulnerabilities (USN-6336-1)	Nessus	Ubuntu Local Security Checks	high
108860	openSUSE Security Update : docker-distribution (openSUSE-2018-336)	Nessus	SuSE Local Security Checks	high
103039	RHEL 7 : docker-distribution (RHSA-2017:2603)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2017-11468

high

Tenable Plugins

high

high

high

high