oras.land/oras-go/v2 vulnerabilities (Go)
7 vulnerabilities.
oras.land/oras-go/v2Gooras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)8.8 Highoras.land/oras-go/v2Gooras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing4.7 Mediumoras.land/oras-go/v2GoORAS Go forwards registry credentials across registry redirects6.9 Mediumoras.land/oras-go/v2Gooras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction7.1 Highoras.land/oras-go/v2Gooras-go: file store write outside workingDir via symlink traversal6.9 Mediumoras.land/oras-go/v2Gooras-go: credential forwarding via unvalidated Location header in blob upload7.5 Highoras.land/oras-go/v2Gooras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens2.1 Low