GO-2021-0072
Uncontrolled resource allocation in github.com/docker/distribution
At a glance
- Published
- Updated
- CVE
- CVE-2017-11468
- Aliases
- GHSA-h62f-wm92-2cmw
Description
Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/docker/distribution | introduced 0, fixed 2.7.0-rc.0+incompatible |
References
- https://github.com/distribution/distribution/pull/2340 FIX
- https://github.com/distribution/distribution/commit/91c507a39abfce14b5c8541cf284330e22208c0f FIX
- https://access.redhat.com/errata/RHSA-2017:2603 WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00047.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |