| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/goharbor/harbor | ≥ 2.0.0, < 2.7.3≥ 2.0.0+incompatible, < 2.7.3+incompatible≥ 2.8.0, < 2.8.3≥ 2.8.0+incompatible, < 2.8.3+incompatible< 1.10.18 | 2.7.32.7.3+incompatible2.8.32.8.3+incompatible1.10.18 |
| harbor | ≥ 2.6.0, ≤ 2.6.4≥ 2.7.0, < 2.7.3≥ 2.8.0, < 2.8.3< 1.10.17 | 2.7.32.8.31.10.17 |
In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69 To avoid this issue, constant time comparison should be used.
subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0
This attack might be possible theoretically, but no workable proof of concept is available, and access complexity is set at High. The jobservice exposes these APIs
Create a job task --- POST /api/v1/jobs
Get job task information --- GET /api/v1/jobs/{job_id}
Stop job task --- POST /api/v1/jobs/{job_id}
Get job log task --- GET /api/v1/jobs/{job_id}/log
Get job execution --- GET /api/v1/jobs/{job_id}/executions
Get job stats --- GET /api/v1/stats
Get job service configuration --- GET /api/v1/config
It is used to create jobs/stop job tasks and retrieve job task information. If an attacker obtains the secrets, it is possible to retrieve the job information, create a job, or stop a job task.
The following versions of Harbor are involved: <=Harbor 2.8.2, <=Harbor 2.7.2, <= Harbor 2.6.x, <=Harbor 1.10.17
Harbor 2.8.3, Harbor 2.7.3, Harbor 1.10.18
Because the jobservice only exposes HTTP service to harbor-core containers, blocking any inbound traffic from the external network to the jobservice container can reduce the risk.
Thanks to Porcupiney Hairs for reporting this issue.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン