pisc

Public OCI-Image Security Checker 公開OCIイメージセキュリティチェッカー 概要 PISC（Public OCI-Image または Docker-Image Security Checker）は、OCIコンテナイメージのセキュリティを評価するコマンドラインツールです。 以下の条件のいずれかに該当する場合、終了コード 1 で終了します。 マルウェア 🍄（エクスプロイト 🐙、ハックツール 👾、バックドア 🐴、暗号通貨マイナー 💰 など 💩）by virustotal 悪用可能なクリティカルな脆弱性 🐞 by...

layerleak

layerleak Layerleak 是一个只读的 OCI 镜像密钥扫描器。它无需 Docker 守护进程即可解析公共镜像引用，根据 OCI 摘要验证下载的内容，重建层状态，检查已删除的构件和镜像元数据，并返回经过脱敏、带有来源信息的发现结果。 它支持 Docker Hub、GHCR、Quay、GCR、MCR、Amazon ECR Public 以及其他兼容 OCI 的注册表。结果可以保存为 JSON，并持久化到 PostgreSQL 中供捆绑的 API 使用。 文档 OpenAPI 规范 变更日志 安全策略 贡献指南 此开发树记录了...

terrier

Terrier Terrier は、OCI イメージとコンテナをスキャンし、特定のファイルがハッシュに基づいて存在するかどうかを識別・検証するためのイメージおよびコンテナ分析ツールです。Terrier の詳細な解説は Heroku ブログ https://blog.heroku.com/terrier-open-source-identifying-analyzing-containers にあります。 インストール バイナリ バイナリからのインストール手順については、リリースページ をご覧ください。 Go 経由 $ go get github.com/heroku/terrier...

dive

dive Dockerイメージ、レイヤーコンテンツを探索し、Docker/OCIイメージのサイズを縮小する方法を見つけるためのツール。 Dockerイメージを分析するには、イメージタグ/ID/ダイジェストを指定してdiveを実行するだけです： dive または、Dockerで直接ダイブすることもできます： alias dive="docker run -ti --rm -v /var/run/docker.sock:/var/run/docker.sock docker.io/wagoodman/dive" dive for example dive nginx:latest...

clair

Clair 注意 : main ブランチは開発中に 不安定または壊れた状態 になる可能性があります。安定したバイナリを入手するには、main ブランチの代わりに releases を使用してください。 Clair は、アプリケーションコンテナ（現在は OCI と docker を含む）の脆弱性の 静的解析 のためのオープンソースプロジェクトです。 クライアントは Clair API を使用してコンテナイメージをインデックス化し、既知の脆弱性と照合できます。...

ALSA-2026:63332 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

EUVD-2026-64141

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...

PT-2026-65053

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RLSA-2026:29195 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

CVE-2026-46703 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host

Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in...

CVE-2026-46703 BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host

Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in...

CVE-2026-46703

Summary of CVE-2026-46703 (Boxlite) : The vulnerability occurs when Boxlite extracts OCI image layer tarballs. A tar entry of type SYMLINK can point to an absolute host path (for example, escape -> /tmp), and subsequent file entries resolve through that symlink, enabling writes outside the ext...

RLSA-2026:19032 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and run OCI containers within them. Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in OCI images, Boxlite does not account for...

PT-2026-41128

Name of the Vulnerable Software and Affected Versions MCP Registry versions prior to 1.7.9 Description OCI ownership validation fails to perform a label-match check when an upstream OCI registry returns an HTTP 429 Too Many Requests error. This occurs because the function ValidateOCI in the file...

ALSA-2026:10135 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

CVE-2026-25140

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

CVE-2026-24845

CVE-2026-24845 affects the malcontent tool. The advisory describes that versions prior to 1.20.3 (starting with 0.10.0) could exfiltrate Docker registry credentials when scanning certain OCI image references. The vulnerability stems from malcontent using google/go-containerregistry for OCI image ...