CVE-2021-21272

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

Deislabs Oras Backlink Vulnerability

Deislabs Oras is a Go-based software from the Deislabs team for pushing OCI packages to the registered end. Deislabs Oras suffers from a backlink vulnerability that can be exploited by an attacker to write or overwrite specific files on a host file system other than the user's...

CVE-2021-21272: Improper Limitation of a Pathname to a Restricted Directory

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

PT-2021-14379

Name of the Vulnerable Software and Affected Versions: ORAS versions 0.4.0 through 0.9.0 Description: The issue is related to a "zip-slip" vulnerability in the directory support feature of ORAS, which allows downloaded gzipped tarballs to be automatically extracted to a user-specified directory...