DirectorySecurity Advisories
Sign In
Security Advisories

CVE-2025-24882

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-24882

CGA ID

CGA-9cch-qj76-7mr9

Severity

5.2

Medium

CVSS V3

Summary

In regclient, pinned manifest digests may be ignored

Description

Impact

A malicious registry could return a different digest for a pinned manifest without detection.

Patches

This has been fixed in the v0.7.1 release.

Workarounds

After running a regclient.ManifestGet, the returned digest can be compared to the requested digest.

References

Affected packages


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images