Package
harbor-scanner-trivy
Component
github.com/docker/distribution
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The only github.com/docker/distribution package linked into the binary is registry/client/auth/challenge, a WWW-Authenticate header parser; the vulnerable registry/client (manifests.Get) and registry/proxy code described in GHSA-685w-q87j-wqw3 is not linked, as confirmed from the shipped binary's symbols. The module is an indirect dependency at v2.8.2+incompatible, and its affected range (<= 2.8.3) has no patched release. The fix, 3.1.2, exists only under the separate github.com/distribution/distribution/v3 module path, which is not part of the build.
Status