BIT-GITLAB-2023-0632 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry...

BIT-HARBOR-2020-13788

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

BIT-HARBOR-2020-13794

Harbor 1.9. 1.10. and 2.0. allows Exposure of Sensitive Information to an Unauthorized Actor...

BIT-HARBOR-2020-29662

In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path...

BIT-HARBOR-2022-46463

An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."...

BIT-HARBOR-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

Malicious code in harbor-container-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis abfc9102901230e03c633dd1570cf01e031ac7de126620021f7860dff85d0201 The OpenSSF Package Analysis project identified 'harbor-container-webhook' @ 1.7.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-1010 Malicious code in harbor-container-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis abfc9102901230e03c633dd1570cf01e031ac7de126620021f7860dff85d0201 The OpenSSF Package Analysis project identified 'harbor-container-webhook' @ 1.7.0 npm as malicious. It is considered malicious because: - The...

On Software Liabilities

Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: "Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for Safe Harbor." Section 1 of this paper sets the stage by briefly describing the problem to be solved. Section ...

Denial Of Service (DOS)

gitlab is vulnerable to Denial Of Service. The vulnerability is due to lack of proper input sanitization in the search functionality of the Harbor Registry, allowing attackers for the execution of a Regular Expression Denial of Service through specially crafted payloads...

harbor-title.com Improper Access Control vulnerability OBB-3800929

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-20902

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

Design/Logic Flaw

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

CVE-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

CVE-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

CVE-2023-20902

CVE-2023-20902 affects Harbor up to specific older branches: 2.6.x and below, 2.7.2 and below, 2.8.2 and below, and 1.10.17 and below. A timing condition in Harbor permits a remote attacker (network access) to create or stop job tasks and to retrieve job task information. No public details beyond...

CVE-2023-20902 Timing attack risk in Harbor

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information...

Harbor Competitive Conditions Issue Vulnerability

Harbor is an open source registry from Harbor Open Source. Protects artifacts with policies and role-based access control, ensures images are scanned and free of vulnerabilities, and signs images as trusted. A security vulnerability exists in Harbor version 2.6.x and earlier, version 2.7.2 and...

Timing Attack

Harbor is vulnerable to timing attacks. The vulnerability is due the comparison of secrets which are not run in constant time. This allows an attacker to decipher response times for cryptographic calculation and secret enumeration, which can result in sensitive information disclosure...

Harbor timing attack risk

In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.goL69-L69 To...