CVE-2017-11468 Docker Registry has Allocation of Resources Without Limits or Throttling
HighCVSS 7.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/distribution(Go) | < 2.7.0-rc.0 | 2.7.0-rc.0 |
| docker github.com/docker/distribution(Go) | < 2.7.0-rc.0+incompatible | 2.7.0-rc.0+incompatible |
| debian/docker-registry(Debian:12) | < 2.6.2~ds1-1 | 2.6.2~ds1-1 |
| debian/docker-registry(Debian:13) | < 2.6.2~ds1-1 | 2.6.2~ds1-1 |
| debian/docker-registry(Debian:14) | < 2.6.2~ds1-1 | 2.6.2~ds1-1 |
| docker registry | <= 2.6.1 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- RHSA-2017:2603 third-party-advisory vendor-advisory
- github.com release-notes third-party-advisory
- openSUSE-SU-2020:1433 broken-link vendor-advisory
- github.com patch
- github.com patch
- pkg.go.dev
- github.com
- github.com product
- Debian Security Tracker CVE-2017-11468 vendor-advisory
- bugs.debian.org issue-tracking