golang-oras-oras-go vulnerabilities (Debian)
6 vulnerabilities.
golang-oras-oras-goDebianoras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)8.8 Highgolang-oras-oras-goDebianoras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing4.7 Mediumgolang-oras-oras-goDebianoras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction7.1 Highgolang-oras-oras-goDebianoras-go: file store write outside workingDir via symlink traversal6.9 Mediumgolang-oras-oras-goDebianoras-go: credential forwarding via unvalidated Location header in blob upload7.5 Highgolang-oras-oras-goDebianoras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens2.1 Low