—
GO-2022-0379
Type confusion in github.com/docker/distribution
빠른 조치
GO-2022-0379 — github.com/docker/distribution: 아래 명령으로 수정 버전으로 올리세요.
go get github.com/docker/distribution@v2.8.0+incompatible상세
Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.
A maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image's digest, invalidating the common pattern of relying on container image digests for equivalence.
This problem has been addressed in newer versions by improving validation in manifest unmarshalling.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / github.com/docker/distribution
최초 영향 버전:
0 수정 버전: 2.8.0+incompatible 수정
go get github.com/docker/distribution@v2.8.0+incompatible