7 matches found
oras-1.3.3-2.1 on GA media (moderate)
oras-1.3.3-2.1 on GA media Announcement ID: openSUSE-SU-2026:11297-1 Rating: moderate Cross-References: CVE-2026-50163 CVSS scores: CVE-2026-50163 SUSE : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
SUSE CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-50163 vulnerabilities
Vulnerabilities for packages: gatekeeper, kubescape-server, ratify-fips, headlamp-fips, crossplane-fips, kots, rancher-fleet-fips, zarf-fips, cloudbeat-fips, trivy-fips, rancher-agent, cilium-cli, rancher-fleet, headlamp, consul-k8s-fips, drone, chartmuseum-fips, crossplane, helm, helmfile,...
