Oras-project Oras vulnerabilities
- oras-project oras-go oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) 8.8 High
- oras-project oras-go oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing 4.7 Medium
- deislabs oras ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption 6.5 Medium
- oras-project oras-go oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction 7.1 High
- oras-project oras-go oras-go: file store write outside workingDir via symlink traversal 6.9 Medium
- linuxfoundation oras, oras-project oras-go +1 more oras-go: credential forwarding via unvalidated Location header in blob upload 7.5 High
- oras-project oras-go oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens 2.1 Low