CVE-2017-11468

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

Specific Go Packages Affected

github.com/docker/distribution/registry/storage github.com/docker/distribution/registry/handlers

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory.

This update for docker-distribution fixes the following issues:

• Enable build on %arm (which include armv6), not only on armv7

• Enable ppc64le

• Use correct URL to project

• Remove fillup, we don't ship a sysconfig file

• Correct systemd requires

• Enable build on ARM

• Upgraded to 2.7.1

  • Support for OCI images added
  • Fix upgrade issues from 2.6.x
  • Update Go version to 1.11
  • Switch to multi-stage Dockerfile
  • Validations enabled by default with new disabled config option
  • Optimize health check performance
  • Create separate permission for deleting objects in a repo
  • Fix storage driver error propagation for manifest GETs
  • Fix forwarded header resolution
  • Add prometheus metrics
  • Disable schema1 manifest by default
  • Graceful shutdown
  • TLS: remove ciphers that do not support perfect forward secrecy
  • Fix registry stripping newlines from manifests
  • Add bugsnag logrus hook
  • Support ARM builds

  This release is a special security release to address an issue allowing an attacker to force arbitrarily-sized memory allocations in a registry instance through the manifest endpoint. The problem has been mitigated by limiting the size of reads for image manifest content. Details for mitigation are in 29fa466 Fixes boo#1049850 (CVE-2017-11468) Fixes boo#1033172

These are all security issues fixed in the docker-distribution-registry-2.7.1-7.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the distribution-registry-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for docker-distribution fixes the following issues:

Security issues fixed:

• CVE-2017-11468: Fixed a denial of service (memory consumption) via the manifest endpoint (bsc#1049850).

Bug fixes:

• bsc#1083474: docker-distirbution-registry overwrites configuration file with update.
• bsc#1033172: Garbage collector needed - or kindly release docker-distribution-registry in Version 2.4.
• Add SuSEfirewall2 service file for TCP port 5000.

It was discovered that Docker Registry incorrectly handled certain crafted input, A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11468)

It was discovered that Docker Registry incorrectly handled certain crafted input. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-2253)