PT-2024-3595 · Jinja+2 · Jinja+2

Marco Benatto · Published 2024-04-10 · Updated 2024-04-26 · CVE-2024-3625

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Quay (affected versions not specified)

Description: A flaw in Quay's storage of its database in plain text within the mirror-registry on Jinja's config.yaml file poses a risk. This issue could allow a malicious actor with access to this file to gain unauthorized access to Quay's Redis instance. The vulnerability is related to the unencrypted storage of critical information in the config.yaml file of the Jinja templating engine, which could enable a remote attacker to exploit the vulnerability and gain access to Quay's Redis instance.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-313

CWE-256

Related Identifiers

BDU:2024-03906

CVE-2024-3625

Affected Products

Jinja

Quay

Redis

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-3625 · Security Note
• https://bdu.fstec.ru/vul/2024-03906 · Security Note
• https://access.redhat.com/security/cve/CVE-2024-3625 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2274408 · Note
• https://vuldb.com/?id.260385 · Note