123 matches found
GHSA-J6HM-V3X2-QV6J land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
Summary ArchiveUtils.untarInputStream, Path and ArchiveUtils.unzipInputStream, Path in land.oras:oras-java-sdk create symbolic-link entries from an archive without validating the symlink target. A malicious tar or zip shipped as an OCI layer blob can place a symlink under the extraction directory...
PT-2026-54777
Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.2 Description A path traversal issue exists in the tar-extraction helper function ensureLinkPath within content/file/utils.go. The function validates that a hardlink target resolves inside the extraction base but...
PT-2026-54776
Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.0 Description During the monolithic blob upload flow, the software follows a registry-controlled Location header and reuses the Authorization header from the initial POST request for the subsequent PUT request. If...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, mountpoint-s3-csi-driver, actions-runner-controller, dgraph, stakater-reloader, flux-image-reflector-controller, flux, aws-network-policy-agent, dkron, external-secrets-operator, metacontroller, polaris,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: kwok, cosign, opensearch-k8s-operator, actions-runner-controller, stakater-reloader, rancher-fleet, litefs, calico, pluto, nodetaint, vexctl, nri-postgresql, memcached-exporter, kubernetes-csi-external-resizer, jitsucom-bulker, hugo-extended, dapr, victoriametrics,...
Malicious code in @mipta1/oras (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e55b7cf41df2b60c003da22e479a06fecaeeebd38526d0d3f24ea8521fafb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2022-0997
Malicious code in bioql PyPI...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: amass, cert-exporter, kwok, docker-credential-ecr-login, nerdctl, actions-runner-controller, stakater-reloader, cni-plugins, haproxy-ingress, litefs, nri-elasticsearch, k3s, caddy, kyverno-policy-reporter-kyverno-plugin, up, newrelic-fluent-bit-output, nodetaint,...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: amass, cert-exporter, kwok, docker-credential-ecr-login, nerdctl, actions-runner-controller, stakater-reloader, cni-plugins, haproxy-ingress, litefs, nri-elasticsearch, k3s, caddy, kyverno-policy-reporter-kyverno-plugin, up, newrelic-fluent-bit-output, nodetaint,...
Software Bill of Materials (SBOM) for your Spin Apps
Learn how to generate, scan, and distribute Software Bill of Materials SBOM for Spin applications using trivy and oras...
OPENSUSE-SU-2024:14554-1 oras-1.2.1-1.1 on GA media
These are all security issues fixed in the oras-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed...
Fedora: Security Advisory for golang-oras-2 (FEDORA-2023-c9b2182a4e)
The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for golang-oras (FEDORA-2023-c9b2182a4e)
The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for golang-oras-1 (FEDORA-2023-c9b2182a4e)
The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 37 Update: golang-oras-2-2.0.0~rc.4-1.fc37
ORAS Go library...
[SECURITY] Fedora 37 Update: golang-oras-1-1.2.1-1.fc37
ORAS Go library...
[SECURITY] Fedora 37 Update: golang-oras-0.15.1-1.20221105git690716b.fc37
Work with OCI registries, but for secure supply chain - managing content like artifacts, images, SBOM...
[SECURITY] Fedora 36 Update: golang-oras-2-2.0.0~rc.4-1.fc36
ORAS Go library...