156 matches found
GHSA-PHW4-MC57-4HWC vulnerabilities
Vulnerabilities for packages: harbor, zot, harbor-fips, kots...
CVE-2025-24976 vulnerabilities
Vulnerabilities for packages: harbor, zot, harbor-fips, kots...
CVE-2025-24976 vulnerabilities
Vulnerabilities for packages: kots, zot...
CVE-2025-23208
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
SUSE CVE-2025-23208
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
GO-2025-3409 Zot IdP group membership revocation ignored in zotregistry.dev/zot
Zot IdP group membership revocation ignored in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
CVE-2025-23208 vulnerabilities
Vulnerabilities for packages: zot...
CVE-2025-23208 vulnerabilities
Vulnerabilities for packages: zot...
CVE-2025-23208
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
CVE-2025-23208 IdP group membership revocation ignored in zot
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
CVE-2025-23208
The CVE-2025-23208 issue affects Zot, an OCI image registry. Root cause: SetUserGroups on login appends new groups instead of replacing existing memberships, stored in boltdb (meta.db), so group revocations/removals from IdPs are ignored. Impact: any configuration using group-based authorization ...
CVE-2025-23208 IdP group membership revocation ignored in zot
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
CVE-2025-23208 IdP group membership revocation ignored in zot
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended...
GHSA-C9P4-XWR9-RFHX vulnerabilities
Vulnerabilities for packages: zot...
GHSA-C9P4-XWR9-RFHX vulnerabilities
Vulnerabilities for packages: zot...
Zot IdP group membership revocation ignored
Summary The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. Details SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the grou...
GHSA-C9P4-XWR9-RFHX Zot IdP group membership revocation ignored
Summary The group data stored for users in the boltdb database meta.db is an append-list so group revocations/removals are ignored in the API. Details SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the grou...
PT-2025-4847 · Boltdb +2 · Boltdb +2
Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.2 Description: The issue arises from the way group data is stored for users in the boltdb database, specifically as an append-list. This leads to group revocations or removals being ignored in the API. When a user lo...
zot 安全漏洞
zot is an OCI image registry open-sourced by The zot Project. A security vulnerability exists in versions prior to zot 2.1.2, which stems from a conflict in the configuration file, where any authorized zot configuration that relies on group-based authorization does not honor group...