PT-2021-11705 · Harbor · Harbor

Javier Provecho · Published 2021-02-02 · Updated 2024-08-21 · CVE-2020-29662

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Harbor versions 2.0 through 2.0.4 Harbor versions 2.1.x through 2.1.1

Description: The catalog's registry API is exposed on an unauthenticated path, allowing bypass of authorization. The vulnerable API endpoint is "GET /v2/ catalog/" which can be accessed without authentication by adding a trailing slash to the path.

Recommendations: For Harbor versions 2.0 through 2.0.4, update to version 2.0.5 to fix this issue immediately. For Harbor versions 2.1.x through 2.1.1, update to version 2.1.2 to fix this issue immediately. As a temporary workaround, consider disabling the vulnerable API endpoint or redirecting it to a 404 sink hole in the ingress if updating to a patched version is not possible.

Fix

Cleartext Transmission of Sensitive Information

Improper Authentication

Weakness Enumeration

CWE-319

CWE-287

Related Identifiers

BIT-HARBOR-2020-29662

CVE-2020-29662

GHSA-38R5-34MR-MVM7

GO-2022-0785

Affected Products

Harbor

References · 13

• https://osv.dev/vulnerability/CVE-2020-29662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29662 · Security Note
• https://osv.dev/vulnerability/BIT-harbor-2020-29662 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0785 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38r5-34mr-mvm7 · Vendor Advisory
• https://github.com/goharbor/harbor/security/advisories/GHSA-38r5-34mr-mvm7 · Note
• https://github.com/goharbor/harbor/commit/c7c409a8e5a8b3fd42841dda84759c9d77977853 · Note
• https://github.com/goharbor/harbor/releases/tag/v2.1.2 · Note
• https://github.com/goharbor/harbor/releases/tag/v2.0.5 · Note
• https://github.com/goharbor/harbor/pull/13676 · Note
• https://github.com/goharbor/harbor/commit/3481722f140e1fdf6e6d290b0cd5c86e509feed4 · Note
• https://t.me/cvenotify/9279 · Telegram Post
• https://t.me/cibsecurity/22976 · Telegram Post