Package
gitlab-runner-helper-fips-19.3
Component
github.com/docker/distribution
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
GHSA-685w-q87j-wqw3 is in the distribution registry client: manifests.Get() does not verify the returned manifest against the requested digest (fixed upstream in internal/client/repository.go, registry/client/repository.go in the v2 module). github.com/docker/distribution v2.8.3+incompatible is an indirect dependency pulled in via github.com/docker/cli v29.7.2. The gitlab-runner and gitlab-runner-helper binaries link only the github.com/docker/distribution/registry/client/auth/challenge package (WWW-Authenticate header parsing). The registry client repository and manifest service code containing the vulnerable function is not compiled into the binaries.
Status
Impact
Waiting on upstream to publish a fixed version for this vulnerability.
Status