Vulnerability in github.com/opencontainers/image-spec
Summary
GHSA-77vh-xpmg-72qh: Clarify mediaType handling. Affects github.com/opencontainers/image-spec versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/opencontainers/image-spec is a Go package that implements the OCI (Open Container Initiative) Image Specification. It provides functionality for working with container images, including manifest and index documents. These documents describe the contents and structure of container images. The package is widely used in containerization and container image management tools.
Vulnerability Detail
The vulnerability identified as GHSA-77vh-xpmg-72qh in github.com/opencontainers/image-spec affects versions 1.0.1 and prior of the OCI Image Specification. The issue arises from the lack of self-description in manifest and index documents. In these versions, documents with a single digest can be interpreted as either a manifest or an index. This ambiguity can lead to incorrect interpretation and processing of container images. The vulnerability has a CVSS score of 3.0, indicating a low severity level.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
go get github.com/opencontainers/image-spec@v1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If software attempting to deserialize an ambiguous document encounters this vulnerability, it can reject the document if it contains both 'manifests' and 'layers' fields or 'manifests' and 'config' fields. This workaround helps mitigate the risk of incorrect interpretation of container images.
Conclusion
The vulnerability in github.com/opencontainers/image-spec can lead to incorrect interpretation and processing of container images. It is recommended to update to version 1.0.2 of the OCI Image Specification to fix the vulnerability. In the meantime, software can implement the suggested workaround to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/image-spec →
FAQ
The vulnerability can lead to incorrect interpretation and processing of container images. This can result in unexpected behavior, security issues, or data corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze dependencies.
The CVSS score of this vulnerability is 3.0, indicating a low severity level.
Yes, software can reject ambiguous documents if they contain specific combinations of fields. This can help mitigate the risk until the vulnerability is fixed.
You can find more information about this vulnerability in the Open Containers Initiative's advisory at https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m.
