Authentication mechanism absence or evasion In docker-registry
Description
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | - | ||
 debian 12 | - | ||
go | 3.1.1 | ||
debian 14 | - | ||
debian 13 | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1.