Repository navigation
Update module github.com/anchore/quill to v0.7.1 [SECURITY] - #304
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Generated by renovateBot
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.4.2→v0.7.1Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval
CVE-2026-31959 / GHSA-7q3q-5px6-4c5p
More information
Details
Impact
Quill before version
v0.7.1contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.
Patches
Fixed in Quill version
v0.7.1Workarounds
None
Credit
Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability
Resources
Severity
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing
CVE-2026-31961 / GHSA-xj69-m9qq-8m94
More information
Details
Impact
Quill before version
v0.7.1contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing.When parsing a Mach-O binary, Quill reads several size and count fields from the
LC_CODE_SIGNATUREload command and embedded code signing structures (SuperBlob,BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields includeDataSize,DataOffset, andSizefrom the load command,Countfrom theSuperBlobheader, andLengthfrom individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files.Patches
Fixed in Quill
v0.7.1Workarounds
None
Credit
Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability
Resources
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Quill has DoS via unbounded read of HTTP response body during notarization
CVE-2026-31960 / GHSA-g32c-4pvp-769g
More information
Details
Impact
Quill before version
v0.7.1has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations.
Patches
Fixed in Quill version
v0.7.1Workarounds
None
Credit
Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability
Resources
Severity
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
anchore/quill (github.com/anchore/quill)
v0.7.1Compare Source
v0.7.1
Security Fixes
(Full Changelog)
v0.7.0Compare Source
v0.7.0
Added Features
Bug Fixes
Additional Changes
(Full Changelog)
v0.6.0Compare Source
v0.5.1Compare Source
v0.5.1
(Full Changelog)
v0.5.0Compare Source
v0.5.0
Added Features
Additional Changes
(Full Changelog)
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.