CVE-2023-20902 Timing attack risk in Harbor

Medium 5.9 Published 9 Nov 2023 Updated 4 Sep 2024

An attacker with network access can exploit a timing condition to create, stop, or retrieve job task information in Harbor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-20902?

CVE-2023-20902 is a medium-severity vulnerability in Harbor Project, published on 9 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

Weakness: CWE-362

Which versions are affected by CVE-2023-20902?

8 open source packages ship an affected version, including github.com/goharbor/harbor and harbor. It affects 1 product.

Package	Affected	Fixed in
`github.com/goharbor/harbor` Go	All versions	`1.10.18, 2.7.3+incompatible, 2.8.3+incompatible`
`github.com/goharbor/harbor` Go	All versions	`1.10.18`
`github.com/goharbor/harbor` Go	All versions	`1.10.18`
`github.com/goharbor/harbor` Go	From `2.0.0`	`2.7.3`
`github.com/goharbor/harbor` Go	From `2.0.0`	`2.7.3`
`github.com/goharbor/harbor` Go	From `2.8.0`	`2.8.3`

2 more packages

`github.com/goharbor/harbor` Go	From `2.8.0`	`2.8.3`
`harbor` Bitnami	All versions	`1.10.17, 2.6.5, 2.7.3, 2.8.3`

Products include Linuxfoundation Harbor.

How do I fix CVE-2023-20902?

Upgrade github.com/goharbor/harbor to a fixed version for your release line: 1.10.18, 2.7.3+incompatible, 2.8.3+incompatible or 2.7.3.

Is CVE-2023-20902 being exploited?

There is no known exploitation of CVE-2023-20902 in the wild and no public exploit code.

Sources

Also known as BIT-harbor-2023-20902, GHSA-mq6f-5xh5-hgcf, GO-2023-2109.