Red Hat Product Errata RHSA-2021:0050 - Security Advisory
Issued:
2021-01-11
Updated:
2021-01-11

RHSA-2021:0050 - Security Advisory

Synopsis

Moderate: Red Hat Quay v3.3.3 bug fix and security update

Type/Severity

Security Advisory: Moderate

Topic

Red Hat Quay v3.3.3 is now available with bug fixes and security updates.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Note: Red Hat Quay v3.3.2 was not released publicly.

Description

This release of Red Hat Quay v3.3.3 includes:

Security Update(s):

  • quay: persistent XSS in repository notification display (CVE-2020-27832)
  • quay: email notifications authorization bypass (CVE-2020-27831)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

  • NVD feed fixed in Clair-v2 (clair-jwt image)

Solution

Download the release images via:

quay.io/redhat/quay:v3.3.3
quay.io/redhat/clair-jwt:v3.3.3
quay.io/redhat/quay-builder:v3.3.3
quay.io/redhat/clair:v3.3.3

Affected Products

  • Red Hat Quay Enterprise 3 x86_64

Fixes

  • BZ - 1905758 - CVE-2020-27831 quay: email notifications authorization bypass
  • BZ - 1905784 - CVE-2020-27832 quay: persistent XSS in repository notification display

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.