Oras-project Oras-go vulnerabilities
- oras-project oras-gooras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)8.8 High
- oras-project oras-gooras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing4.7 Medium
- oras-project oras-gooras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction7.1 High
- oras-project oras-gooras-go: file store write outside workingDir via symlink traversal6.9 Medium
- linuxfoundation oras, oras-project oras-go +1 moreoras-go: credential forwarding via unvalidated Location header in blob upload7.5 High
- oras-project oras-gooras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens2.1 Low