VDB
Sign up
—

GO-2021-0081

Insufficiently Protected Credentials in github.com/containers/image

Quick fix

GO-2021-0081 — github.com/containers/image: upgrade to the fixed version with the command below.

go get github.com/containers/image@v2.0.2-0.20190802080134-634605d06e73+incompatible

Details

The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/containers/image
Introduced in: 0Fixed in: 2.0.2-0.20190802080134-634605d06e73+incompatible
Fixgo get github.com/containers/image@v2.0.2-0.20190802080134-634605d06e73+incompatible

References