SB2020010216 - Insufficiently protected credentials in Quay
Published: January 2, 2020 Updated: August 8, 2020
Security Bulletin ID
SB2020010216
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficiently protected credentials (CVE-ID: CVE-2019-10205)
The vulnerability allows a local privileged user to #BASIC_IMPACT#.
A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.
Remediation
Install update from vendor's website.