DirectorySecurity Advisories
Sign In
Security Advisories

CGA-g59m-4p34-cj7j

Published

Last updated

https://images.chainguard.dev/security/CGA-g59m-4p34-cj7j
Package

guac

Latest Update
Fixed
Fixed Version

0.8.0-r2

Aliases
  • GHSA-qv35-3gw6-8q4j

Severity

5.2

Medium

CVSS V3

Summary

In regclient, pinned manifest digests may be ignored

Description

Impact

A malicious registry could return a different digest for a pinned manifest without detection.

Patches

This has been fixed in the v0.7.1 release.

Workarounds

After running a regclient.ManifestGet, the returned digest can be compared to the requested digest.

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images