mirror registry for Red Hat OpenShift 2: server-side request forgery

A flaw was found in Red Hat Quay's repository-level mirror configuration

feature. The POST and PUT handlers in endpoints/api/mirror.py accept an

external_reference parameter without SSRF validation, unlike the

organization-level mirror handlers which apply validate_external_registry_url().

A repository administrator can supply a crafted hostname that causes the Quay

mirror worker to make requests via Skopeo to internal network services, cloud

metadata endpoints, or other resources not intended to be reachable from the

Quay application.