PT-2020-10036 · Vmware+1 · Vmware Harbor Container Registry+1

Published 2020-03-20 · Updated 2024-08-21 · CVE-2019-19026

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Native Computing Foundation Harbor versions prior to 1.8.6 and 1.9.3

Description The issue allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform. This is a problem related to the handling of project quotas, which can be exploited to inject SQL code.

Recommendations For versions prior to 1.8.6, update to version 1.8.6 or later. For versions prior to 1.9.3, update to version 1.9.3 or later. As a temporary workaround, consider restricting access to project quotas in the VMware Harbor Container Registry until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-19026

GHSA-RH89-VVRG-FG64

GHSA-W4X5-JQQ4-QC8X

GO-2022-0883

Affected Products

Harbor

Vmware Harbor Container Registry

References · 10

• https://osv.dev/vulnerability/CVE-2019-19026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19026 · Security Note
• https://osv.dev/vulnerability/GHSA-w4x5-jqq4-qc8x · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0883 · Vendor Advisory
• https://github.com/goharbor/harbor/security/advisories · Note
• https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64 · Note
• https://tanzu.vmware.com/security/cve-2019-19026 · Note
• https://t.me/cvenotify/1931 · Telegram Post
• https://github.com/advisories/GHSA-w4x5-jqq4-qc8x · Note
• https://t.me/k8security/85 · Telegram Post