PT-2020-10037 · Vmware+1 · Vmware Harbor Container Registry+1

Published 2020-03-20 · Updated 2024-08-21 · CVE-2019-19029

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cloud Native Computing Foundation Harbor versions prior to 1.8.6 and 1.9.3

Description The issue allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform. This is a result of a flaw in the Cloud Native Computing Foundation Harbor.

Recommendations For versions prior to 1.8.6, update to version 1.8.6 or later. For versions prior to 1.9.3, update to version 1.9.3 or later. As a temporary workaround, consider restricting access to the user-groups functionality until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-19029

GHSA-JR34-MFF8-PC6F

GHSA-QCFV-8V29-469W

GO-2022-0853

Affected Products

Harbor

Vmware Harbor Container Registry

References · 14

• https://osv.dev/vulnerability/GO-2022-0853 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/645988 · Security Note
• https://osv.dev/vulnerability/GHSA-jr34-mff8-pc6f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19029 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19029 · Vendor Advisory
• https://github.com/goharbor/harbor · Note
• https://github.com/goharbor/harbor/security/advisories · Note
• https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w · Note
• https://pkg.go.dev/vuln/GO-2022-0853 · Note
• https://github.com/advisories/GHSA-jr34-mff8-pc6f · Note
• https://tanzu.vmware.com/security/cve-2019-19029 · Note
• https://t.me/cvenotify/1932 · Telegram Post
• https://t.me/k8security/85 · Telegram Post
• https://t.me/cvenotify/11619 · Telegram Post