Package
rancher-system-agent-0.13-assets
Component
github.com/docker/distribution
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
Only the registry/client/auth/challenge package of github.com/docker/distribution (the WWW-Authenticate header parser) is compiled into the binary; the vulnerable registry/client (manifests.Get) and registry/proxy code described in GHSA-685w-q87j-wqw3 is not linked, as confirmed from the shipped binary's symbols. The module is an indirect dependency at v2.8.2+incompatible whose affected range (<= 2.8.3) has no patched release. The fix, 3.1.2, exists only under the separate github.com/distribution/distribution/v3 module path, which is not part of the build.
Status
Impact
Waiting on upstream to publish a fixed version for this vulnerability.
Status