CGA-9cch-qj76-7mr9

Summary

In regclient, pinned manifest digests may be ignored

Description

Impact

A malicious registry could return a different digest for a pinned manifest without detection.

Patches

This has been fixed in the v0.7.1 release.

Workarounds

After running a regclient.ManifestGet, the returned digest can be compared to the requested digest.