Description (CNA)
A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / mirror registry for Red Hat OpenShift 2.0 | unaffected 1782177012 before * |
| Red Hat / Red Hat Quay 3.10 | unaffected 1779822261 before * |
| Red Hat / Red Hat Quay 3.12 | unaffected 1779811412 before * |
| Red Hat / Red Hat Quay 3.14 | unaffected 1779689392 before * |
| Red Hat / Red Hat Quay 3.15 | unaffected 1780891395 before * |
| Red Hat / Red Hat Quay 3.16 | unaffected 1779204086 before * |
| Red Hat / Red Hat Quay 3.17 | unaffected 1779922205 before * |
| Red Hat / Red Hat Quay 3.17 | unaffected 1780604033 before * |
| Red Hat / Red Hat Quay 3.18 | unaffected 1784987273 before * |
| Red Hat / Red Hat Quay 3.9 | unaffected 1779811473 before * |
| Red Hat / mirror registry for Red Hat OpenShift | affected |
CWE
CWE-502
References
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24833
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/errata/RHSA-2026:28441
- https://access.redhat.com/errata/RHSA-2026:48085
- https://access.redhat.com/security/cve/CVE-2026-32590
- https://bugzilla.redhat.com/show_bug.cgi?id=2446964
ADP enrichment
No English description supplied.
No references supplied.