Threats tagged 'ghsa-rg7f-fcx2-cjw3'

A Server-Side Request Forgery (SSRF) vulnerability exists in Red Hat Quay's build API. An authenticated user with repository write access and the FEATURE_BUILD_SUPPORT enabled can exploit this flaw by providing a malicious URL, causing the Quay builder to make requests to internal network addresses. This could lead to disclosure of sensitive internal information. The vulnerability requires specific configuration and privileges, limiting the attack surface. The vendor recommends disabling the FEATURE_BUILD_SUPPORT feature if it is not essential to mitigate the issue.