A remote code execution (RCE) vulnerability was identified in Red Hat Quay v3.12.x resulting from the unsafe use of Python's pickle module to serialize and deserialize hashlib state objects stored in the database. The affected fields — sha_state and piece_sha_state on the BlobUpload model — store the in-progress SHA-256 and SHA-1 hash state for resumable container image layer uploads.

Requirements to exploit: Attacker needs to be logged into the web app / initiate podman execution from host.

Component affected:
Mirror Registry for OpenShift – BlobUpload functionality / affected database column sha_state

Version affected: latest release