A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validate_external_registry_url(). A repository administrator can supply a crafted hostname that causes the Quay mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the Quay application.

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity quay: mirror-registry: SSRF: repo-level mirror accepts external_reference without URL validation golang: Go os.Root: Symlink following vulnerability allows directory traversal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file podman: Podman: Information disclosure via malicious container image environment variables Pillow: Pillow: Native heap out-of-bounds write Pillow: Pillow: Denial of Service via out-of-bounds write in image processing Pillow: Pillow: Denial of service via crafted PDF stream Pillow: Pillow: Denial of Service via crafted JPEG2000 image Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API js-yaml: js-yaml: Denial of Service via crafted YAML documents pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values