Detections
Analytics

SCA: security update for github.com/artifacthub/hub (GHSA-g6pq-x539-7w4j)

medium Tenable Cloud Security Plugin ID 414937

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Artifact Hub is a web-based application that enables finding, installing, and publishing packages and
 configurations for CNCF projects. During a security audit of Artifact Hub's code base a security
 researcher identified a bug in which the `registryIsDockerHub` function was only checking that the
 registry domain had the `docker.io` suffix. Artifact Hub allows providing some Docker credentials that are
 used to increase the rate limit applied when interacting with the Docker Hub registry API to read publicly
 available content. Due to the incorrect check described above, it'd be possible to hijack those
 credentials by purchasing a domain which ends with `docker.io` and deploying a fake OCI registry on it.
 <https://artifacthub.io/> uses some credentials that only have permissions to read public content
 available in the Docker Hub. However, even though credentials for private repositories (disabled on
 `artifacthub.io`) are handled in a different way, other Artifact Hub deployments could have been using
 them for a different purpose. This issue has been resolved in version `1.16.0`. Users are advised to
 upgrade. There are no known workarounds for this vulnerability. (CVE-2023-45821)

See Also

https://github.com/advisories/GHSA-g6pq-x539-7w4j

Plugin Details

Severity: Medium

ID: 414937

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.57

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2023-45821

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/19/2023

Vulnerability Publication Date: 10/19/2023

Reference Information

CVE: CVE-2023-45821

cwe: CWE-494