CVE-2023-20902

MEDIUM5.9EPSS 0.30%

Harbor timing attack risk

發布日:2023/10/10修改日:2026/3/13

描述

In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69 To avoid this issue, constant time comparison should be used. ``` subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0 ``` ### Impact This attack might be possible theoretically, but no workable proof of concept is available, and access complexity is set at High. The jobservice exposes these APIs ``` Create a job task --- POST /api/v1/jobs Get job task information --- GET /api/v1/jobs/{job_id} Stop job task --- POST /api/v1/jobs/{job_id} Get job log task --- GET /api/v1/jobs/{job_id}/log Get job execution --- GET /api/v1/jobs/{job_id}/executions Get job stats --- GET /api/v1/stats Get job service configuration --- GET /api/v1/config ``` It is used to create jobs/stop job tasks and retrieve job task information. If an attacker obtains the secrets, it is possible to retrieve the job information, create a job, or stop a job task. The following versions of Harbor are involved: <=Harbor 2.8.2, <=Harbor 2.7.2, <= Harbor 2.6.x, <=Harbor 1.10.17 ### Patches Harbor 2.8.3, Harbor 2.7.3, Harbor 1.10.18 ### Workarounds Because the jobservice only exposes HTTP service to harbor-core containers, blocking any inbound traffic from the external network to the jobservice container can reduce the risk. ### Credits Thanks to Porcupiney Hairs for reporting this issue.

受影響套件(3)

Bitnami/harborfrom 0, < 1.10.17, >= 2.6.0, < 2.6.5, >= 2.7.0, < 2.7.3, >= 2.8.0, < 2.8.3
Go/github.com/goharbor/harborfrom 0, < 1.10.18
Go/github.com/goharbor/harborfrom 0, < 1.10.18, >= 2.0.0+incompatible, < 2.7.3+incompatible, >= 2.8.0+incompatible, < 2.8.3+incompatible

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

描述

受影響套件(3)

CVSS 分數

參考連結(7)