GO-2025-3409 Zot IdP group membership revocation ignored in zotregistry.dev/zot

Zot IdP group membership revocation ignored in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...

CVE-2025-23208 vulnerabilities

Vulnerabilities for packages: zot...

CVE-2025-23208

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

CVE-2025-23208 vulnerabilities

Vulnerabilities for packages: zot...

CVE-2025-23208

The CVE-2025-23208 issue affects Zot, an OCI image registry. Root cause: SetUserGroups on login appends new groups instead of replacing existing memberships, stored in boltdb (meta.db), so group revocations/removals from IdPs are ignored. Impact: any configuration using group-based authorization ...

CVE-2025-23208 IdP group membership revocation ignored in zot

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

CVE-2025-23208 IdP group membership revocation ignored in zot

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

CVE-2025-23208 IdP group membership revocation ignored in zot

zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...

GHSA-C9P4-XWR9-RFHX Zot IdP group membership revocation ignored

Summary The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. Details SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the grou...

GHSA-C9P4-XWR9-RFHX vulnerabilities

Vulnerabilities for packages: zot...

GHSA-C9P4-XWR9-RFHX vulnerabilities

Vulnerabilities for packages: zot...

Zot IdP group membership revocation ignored

Summary The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. Details SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the grou...

zot 安全漏洞

zot is an OCI image registry open-sourced by The zot Project. A security vulnerability exists in versions prior to zot 2.1.2, which stems from a conflict in the configuration file, where any authorized zot configuration that relies on group-based authorization does not honor group...

PT-2025-4847 · Boltdb +2 · Boltdb +2

Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.2 Description: The issue arises from the way group data is stored for users in the boltdb database, specifically as an append-list. This leads to group revocations or removals being ignored in the API. When a user lo...

GHSA-MC76-5925-C5P6 vulnerabilities

Vulnerabilities for packages: skopeo-fips, podman, buildah, skopeo, zot...

GHSA-MC76-5925-C5P6 vulnerabilities

Vulnerabilities for packages: zot, skopeo, buildah, podman...

CVE-2024-9341 vulnerabilities

Vulnerabilities for packages: zot, skopeo, buildah, podman...

CVE-2024-9341 vulnerabilities

Vulnerabilities for packages: skopeo-fips, podman, buildah, skopeo, zot...

GHSA-4F8R-QQR9-FQ8J vulnerabilities

Vulnerabilities for packages: trivy-fips, spire-server, zarf, tkn-fips, neuvector-sigstore-interface, gitsign, melange, cosign-fips, policy-controller, apko, trivy, spire-server-fips, slsa-verifier, flux-source-controller, policy-controller-fips, rekor, kubescape, tekton-chains-fips, tkn,...

CVE-2024-47534 vulnerabilities

Vulnerabilities for packages: trivy-fips, spire-server, zarf, tkn-fips, neuvector-sigstore-interface, gitsign, melange, cosign-fips, policy-controller, apko, trivy, spire-server-fips, slsa-verifier, flux-source-controller, policy-controller-fips, rekor, kubescape, tekton-chains-fips, tkn,...