Package
gitness
Component
github.com/docker/distribution
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GHSA-685w-q87j-wqw3 is a flaw in the registry client's manifest digest verification: manifests.Get() does not verify returned content against the requested digest. The advisory's fixing commits (8f91c26c, 960439b0) touch only the client's repository.go and its test.
The binary links exactly one package from github.com/docker/distribution: the reference image-name parser. Verified against the shipped binary with "go version -m" and "go tool nm": symbols exist for reference only, with zero matches for registry/client or registry/proxy. reference does not itself import the client.
The module is flagged because the SBOM records the whole module at v2.8.2+incompatible, not the subset of packages actually linked.
Status
Impact
Waiting on upstream to publish a fixed version for this vulnerability.
Status