Red Hat Quay Resumable Uploads Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Red Hat Quay version 3.12.x, arising from the insecure handling of resumable container image layer uploads. The application uses Python's pickle module to serialize and deserialize hash state objects, which are then stored in the database. This process can be manipulated to execute arbitrary code on the Quay server. Exploitation requires valid login credentials, either through the web interface or via a container tool like Podman.

Impact

Exploitation of this vulnerability allows authenticated users to execute arbitrary code on the Quay server.