{"affected":[{"ecosystem_specific":{"binaries":[{"docker-distribution-registry":"2.7.1-bp152.4.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP2","name":"docker-distribution","purl":"purl:rpm/suse/docker-distribution&distro=SUSE%20Package%20Hub%2015%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.7.1-bp152.4.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for docker-distribution fixes the following issues:\n\n- Enable build on %arm (which include armv6), not only on armv7\n\n- Enable ppc64le\n\n- Use correct URL to project\n- Remove fillup, we don't ship a sysconfig file\n- Correct systemd requires\n- Enable build on ARM\n\n- Upgraded to 2.7.1\n  - Support for OCI images added\n  - Fix upgrade issues from 2.6.x\n  - Update Go version to 1.11\n  - Switch to multi-stage Dockerfile\n  - Validations enabled by default with new disabled config option\n  - Optimize health check performance\n  - Create separate permission for deleting objects in a repo\n  - Fix storage driver error propagation for manifest GETs\n  - Fix forwarded header resolution\n  - Add prometheus metrics\n  - Disable schema1 manifest by default\n  - Graceful shutdown\n  - TLS: remove ciphers that do not support perfect forward secrecy\n  - Fix registry stripping newlines from manifests\n  - Add bugsnag logrus hook\n  - Support ARM builds\n\n  This release is a special security release to address an issue allowing\n  an attacker to force arbitrarily-sized memory allocations in a registry\n  instance through the manifest endpoint. The problem has been mitigated\n  by limiting the size of reads for image manifest content.\n  Details for mitigation are in 29fa466\n  Fixes boo#1049850 (CVE-2017-11468)\n  Fixes boo#1033172\n","id":"openSUSE-SU-2020:1433-1","modified":"2020-09-14T22:22:08Z","published":"2020-09-14T22:22:08Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MY76ZZYS6OXIXX3XVR5TNDLWGWIO22UJ/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1033172"},{"type":"REPORT","url":"https://bugzilla.suse.com/1049850"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-11468"}],"related":["CVE-2017-11468"],"summary":"Security update for docker-distribution"}