Bug 1768293 (CVE-2019-3864)
| Summary: | CVE-2019-3864 quay: CSRF token does not expire and is leaked in query string | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jason Shepherd <jshepherd> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bdettelb, jschorr, tomckay |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | quay-3.0.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was discovered in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-11 06:51:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1768294 | ||
|
Description
Jason Shepherd
2019-11-04 01:20:06 UTC
Acknowledgments: Name: Jeremy Choi (Red Hat) This was addressed in a change made in July, where tokens are now rotated on every user login. We attempted to refresh on every request, but as we can support multiple concurrent requests on our API, the state management of doing so started to become unwieldily and unreliable. Further, with the introduction of default Same-Site cookies, this has become even less of a concern. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3864 |