Fedora Account System
Red Hat Associate
Red Hat Customer
A denial-of-service issue was reported in claircore (used by Clair, including with Quay). When indexing certain container image layers, the apk package scanner can panic on malformed package-database content. That panic is not handled on the indexing path, so it can terminate the indexer process. An attacker who can get a crafted image layer indexed may trigger this condition.
CVSS Justification: A:H -> A:L A:H fits a long-lived single indexer process that dies for everyone until manually recovered. A:L fits typical Quay/Clair on OpenShift/k8s: pod dies, kubelet restarts it, impact is a short indexing blip / log noise, not lasting outage - unless someone can crash-loop it continuously (still usually scored A:L when recovery is automatic).