GO-2023-1772

Source
https://vuln.go.dev/ID/GO-2023-1772.json
Aliases
Published
2023-05-24T18:13:11Z
Modified
2023-05-24T18:13:11Z
Details

Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/_catalog API endpoint request.

References

Affected packages

Go / github.com/distribution/distribution

github.com/distribution/distribution

Affected ranges

Type
SEMVER
Events
Introduced
0
Fixed
2.8.2-beta.1+incompatible

Affected versions

Ecosystem specific 

{
    "imports": [
        {
            "path": "github.com/distribution/distribution/registry/handlers",
            "symbols": [
                "catalogHandler.GetCatalog"
            ]
        }
    ]
}