Vulnerability · Published Oct 17, 2024 · Assigned by redhat

CVE-2024-9683Quay: quay allows successful authentication with trucated version of the password

Medium 4.8

In plain English

A medium-severity security flaw in quay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement. While the risk is relatively low due to the typical length of the passwords used (73 characters), this vulnerability can still be exploited to reduce the complexity of brute-force or password-guessing attacks. The truncation of passwords weakens the overall authentication process, thereby reducing the effectiveness of password policies and potentially increasing the risk of unauthorized access in the future.

Affected products (as reported)

Vendor	Product	Versions
	quay	3.8.14
Red Hat	Red Hat Quay 3	see references

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2024-9683 vdb-entry, x_refsource_REDHAT
RHBZ#2317559 issue-tracking, x_refsource_REDHAT