{"id":"openSUSE-SU-2020:1433-1","summary":"Security update for docker-distribution","details":"This update for docker-distribution fixes the following issues:\n\n- Enable build on %arm (which include armv6), not only on armv7\n\n- Enable ppc64le\n\n- Use correct URL to project\n- Remove fillup, we don't ship a sysconfig file\n- Correct systemd requires\n- Enable build on ARM\n\n- Upgraded to 2.7.1\n  - Support for OCI images added\n  - Fix upgrade issues from 2.6.x\n  - Update Go version to 1.11\n  - Switch to multi-stage Dockerfile\n  - Validations enabled by default with new disabled config option\n  - Optimize health check performance\n  - Create separate permission for deleting objects in a repo\n  - Fix storage driver error propagation for manifest GETs\n  - Fix forwarded header resolution\n  - Add prometheus metrics\n  - Disable schema1 manifest by default\n  - Graceful shutdown\n  - TLS: remove ciphers that do not support perfect forward secrecy\n  - Fix registry stripping newlines from manifests\n  - Add bugsnag logrus hook\n  - Support ARM builds\n\n  This release is a special security release to address an issue allowing\n  an attacker to force arbitrarily-sized memory allocations in a registry\n  instance through the manifest endpoint. The problem has been mitigated\n  by limiting the size of reads for image manifest content.\n  Details for mitigation are in 29fa466\n  Fixes boo#1049850 (CVE-2017-11468)\n  Fixes boo#1033172\n","modified":"2026-03-11T07:32:40.047803Z","published":"2020-09-14T22:22:08Z","related":["CVE-2017-11468"],"upstream":["CVE-2017-11468"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MY76ZZYS6OXIXX3XVR5TNDLWGWIO22UJ/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033172"},{"type":"REPORT","url":"https://bugzilla.suse.com/1049850"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-11468"}],"affected":[{"package":{"name":"docker-distribution","ecosystem":"SUSE:Package Hub 15 SP2","purl":"pkg:rpm/suse/docker-distribution&distro=SUSE%20Package%20Hub%2015%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-bp152.4.3.1"}]}],"ecosystem_specific":{"binaries":[{"docker-distribution-registry":"2.7.1-bp152.4.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:1433-1.json"}}],"schema_version":"1.7.5"}