Malicious code in oci-plugin-compliance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 762cb43037a71931178ccf3452552b84331b30ada3f192f5d979eed5b372da3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview oci-console-plugin-registry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-47334 Malicious code in oci-plugin-compliance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 762cb43037a71931178ccf3452552b84331b30ada3f192f5d979eed5b372da3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in oci-console-plugin-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19ce011b024c9c3dcf78578cbf559de94a96364525ace53ce28457dba2053bf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:20692-1 Security update for podman

This update for podman fixes the following issues: - CVE-2025-6032: Machine init command fails to verify TLS certificate when downloading VM images from an OCI registry bsc1245320...

ROS-20250807-02

The vulnerability of the Podman OCI container management and launching software tool is related to errors in the in the certificate authentication procedure. Exploitation of the vulnerability could allow an attacker, acting remotely to execute a man-in-the-middle attack...

SUSE-SU-2025:02592-1 Security update for cosign

This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...

The vulnerability of the Podman software for managing and launching OCI containers is related to errors in the certificate validation process, allowing an attacker to execute a “man-in-the-middle” attack.

The vulnerability of the Podman software for managing and launching OCI containers is related to errors in the certificate validation process. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

CVE-2025-53945

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

CVE-2025-53945

CVE-2025-53945 concerns apko, Chainguard’s tool for building/publishing OCI images. Affected versions prior to 0.29.5 inadvertently set critical files to 0666 permissions, notably /etc/ld.so.cache, enabling a local unprivileged user to potentially influence the dynamic loader path by placing a ma...

CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack though incorrect handling of the OCI hook createContainer during container initialization when update-ldcache is used. An attacker can modify data or disrupt service by supplying a specially crafted container image that...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : umoci (SUSE-SU-2025:02282-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02282-1 advisory. Update to umoci v0.5.0. Upstream changelog is available from bsc1243388 A security flaw was found in the...

Medium: oci-add-hooks

Issue Overview: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 Affected Packages: oci-add-hooks Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn mor...

Medium: oci-add-hooks

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2025-075)

The version of oci-add-hooks installed on the remote host is prior to 0-0.4.20200504git325a340. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-075 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially...

Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2025-069)

The version of oci-add-hooks installed on the remote host is prior to 0-0.4.20200504git325a340. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-069 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects...

podman: podman missing TLS verification

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...