CVE-2023-20902
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.
| Software | From | Fixed in |
|---|---|---|
github.com/goharbor/harbor
|
- | 1.10.18 |
|
github.com/goharbor/harbor
|
2.0.0 | 2.7.3 |
|
github.com/goharbor/harbor
|
2.8.0 | 2.8.3 |
| linuxfoundation / harbor | - | 1.10.17 |
| linuxfoundation / harbor | 2.8.0 | 2.8.3 |
| linuxfoundation / harbor | 2.7.0 | 2.7.3 |
| linuxfoundation / harbor | 2.6.0 | 2.6.4.x |
- https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69
- https://github.com/goharbor/harbor/releases/tag/v1.10.18
- https://github.com/goharbor/harbor/releases/tag/v2.7.3
- https://github.com/goharbor/harbor/releases/tag/v2.8.3
- https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime