GHSA-vh4v-2xq2-g5cg
MediumSummary
The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.
Risk Assessment
An attacker could exploit registry redirects to intercept authentication credentials, potentially leading to unauthorized access to private container registries.
Recommendation
Immediately update the ORAS Go library to the latest patched version and verify redirect configurations in used registries.
Original NVD description (English source)
# ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU ## Summary ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects. There are two related paths: 1. A manifest or metada