Go/github.com/goharbor/harbor CVE-2023-20902: medium 5.9, EPSS 0.45%

Harbor timing attack risk

Action: Upgrade github.com/goharbor/harbor to 1.10.18 or later.

go get github.com/goharbor/harbor@v1.10.18

go get github.com/goharbor/harbor@v2.7.3

go get github.com/goharbor/harbor@v2.8.3

Affected

Fixed versions

Sources

• osv: GHSA-mq6f-5xh5-hgcf
• https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf
• https://nvd.nist.gov/vuln/detail/CVE-2023-20902
• https://github.com/goharbor/harbor
• https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69
• https://github.com/goharbor/harbor/releases/tag/v1.10.18
• https://github.com/goharbor/harbor/releases/tag/v2.7.3
• https://github.com/goharbor/harbor/releases/tag/v2.8.3

CVE-2023-20902 · published 2023-10-10T21:29:02Z · modified 2026-07-08T06:53:11.997758248Z · JSON