CVE-2017-11468
Fixed in a distro release EPSS 3%
Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
Products: docker_registry, redhat enterprise_linux_server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/docker/distribution | 2.7.0-rc.0 |
| Go | github.com/docker/distribution | 2.7.0-rc.0+incompatible |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | docker-registry | 2.6.2~ds1-1 |
| Debian 13 | docker-registry | 2.6.2~ds1-1 |
| Debian 14 | docker-registry | 2.6.2~ds1-1 |
| Red Hat rhel extras other 7 | docker-distribution | 0:2.6.2-1.git48294d9.el7 |
| SUSE Linux Enterprise Module for Containers 12 | docker-distribution | 2.6.2-13.6.1 |
| SUSE Package Hub 15 SP2 | docker-distribution | 2.7.1-bp152.4.3.1 |
| Ubuntu 20.04 LTS | docker-registry | 2.7.1+ds2-7ubuntu0.3 |
| Ubuntu Pro 16.04 LTS | docker-registry | 2.3.0~ds1-1ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | docker-registry | 2.6.2~ds1-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | docker-registry | 2.8.0+ds1-4ubuntu0.1~esm2 |
| openSUSE Tumbleweed | distribution-registry | 2.8.1-1.1 |
| openSUSE Tumbleweed | docker-distribution-registry | 2.7.1-7.2 |