GitHub Advisoryadvisory · Go

GHSA-qv35-3gw6-8q4j In regclient, pinned manifest digests may be ignored

MEDIUM Published 2024-08-05 Modified 2025-01-29 Official page ↗
Aliases
CVE-2025-24882
Ecosystem
Go
Packages
github.com/regclient/regclient
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N
Weaknesses
CWE-20, CWE-345
Reviewed
2024-08-05

Affected packages

• Go github.com/regclient/regclient: < 0.7.1 → fixed in 0.7.1

Description

Impact A malicious registry could return a different digest for a pinned manifest without detection. Patches This has been fixed in the v0.7.1 release. Workarounds After running a `regclient.ManifestGet`, the returned digest can be compared to the requested digest.

Related

Alias · CVE (1)

  • CVE-2025-24882 regclient is a Docker and OCI Registry Client in Go. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References