Package
kubevela-vela-core-fips
Component
oras.land/oras-go
Latest update
4.7
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The shipped binary contains oras.land/oras-go v1.2.5, the v1 module used by the Helm client libraries in KubeVela. Its registry tag-listing code follows the pagination Link header returned by the registry without checking that it points to the same host, which is the behavior oras.land/oras-go/v2 2.6.2 fixed by restricting pagination to the same origin. No fixed release exists on the oras-go v1 line, and remediation depends on KubeVela upstream moving to a Helm release built on oras.land/oras-go/v2 2.6.2 or later.
Status