PT-2020-2293 · Red Hat · Red Hat Quay

Sean Smith · Published 2020-01-02 · Updated 2023-02-12 · CVE-2019-10205

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description A flaw in Red Hat Quay allows robot account tokens to be stored in plain text. This could enable an attacker, who can perform database queries in the Red Hat Quay database, to use these tokens and access container images stored in the registry, potentially allowing them to read or write these images. The issue is related to insufficient protection of registration data, which could allow an attacker to bypass container protection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2020-02261

CVE-2019-10205

Affected Products

Red Hat Quay

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10205 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10205 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02261 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10205 · Security Note
• https://access.redhat.com/security/cve/cve-2019-10205 · Note