25 matches found
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...
EUVD-2026-99225
Distribution: Client manifests.Get does not verify returned content against requested digest...
GHSA-685W-Q87J-WQW3 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...
CVE-2026-85747
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
Linux Distros Unpatched Vulnerability : CVE-2026-85747
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a...
DEBIAN-CVE-2026-85747
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
CVE-2026-85747
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Get method of the manifests type in registry/client/repository.go, which reads the response body and passes it to distribution.UnmarshalManifest without computing digest.FromBytesbody...
CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
CVE-2026-85747
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.manifests.Get reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a...
CVE-2026-85747
Distribution , a toolkit for handling container content, is vulnerable in versions prior to 3.1.2 . The registry/client.(*manifests).Get() function fails to verify returned content against a requested digest during digest-pinned requests, allowing a malicious or intercepted registry response to s...
PT-2026-111868
Name of the Vulnerable Software and Affected Versions Distribution versions prior to 3.1.2 Description The registry/client.manifests.Get function reads a manifest for a digest-pinned request and passes it to distribution.UnmarshalManifest without verifying the body against the requested digest...
rubygem-katello: SQL injection in Registry Proxy via labels
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...
rubygem-katello: SQL injection in Registry Proxy via labels
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...
rubygem-katello: SQL injection in Registry Proxy via labels
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...
CVE-2026-56097
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...
CVE-2026-56097
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...
EUVD-2026-90970
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...