CVE-2025-23208

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Summary

The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API.

Details

SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case.

PoC

Login with group claims, logout, remove the user from a group from at IdP and log in again, the API still grants access and the new list of groups is appended creating meaningless duplicate entries and no longer mathing the expected groups from the IdP. The behavior can be verified by seeing the API or UI still presenting images it should not or by viewing the data directly: bbolt get meta.db UserData <user>, eg:

Note this example also has duplicates due to group hierarchy changes that were left in the database.

Impact

Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP.

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Summary

The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API.

Details

SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case.

PoC

Login with group claims, logout, remove the user from a group from at IdP and log in again, the API still grants access and the new list of groups is appended creating meaningless duplicate entries and no longer mathing the expected groups from the IdP. The behavior can be verified by seeing the API or UI still presenting images it should not or by viewing the data directly: bbolt get meta.db UserData <user>, eg:

Note this example also has duplicates due to group hierarchy changes that were left in the database.

Impact

Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP.

Zot IdP group membership revocation ignored in zotregistry.dev/zot.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: zotregistry.dev/zot before v2.1.2.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
  • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
  • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
  • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
  • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
  • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
  • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
  • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
  • GO-2025-3422 CVE-2025-24354

• Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3372 CVE-2024-45339
  • GO-2025-3373 CVE-2024-45341
  • GO-2025-3383 CVE-2024-45340
  • GO-2025-3420 CVE-2024-45336
  • GO-2025-3421 CVE-2025-22865

• Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
  • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
  • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
  • GO-2025-3396 CVE-2024-52594
  • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
  • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
  • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
  • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
  • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
  • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

• Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
  • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
  • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
  • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
  • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

• Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
  • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
  • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
  • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79