Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
google/go-containerregistry
main @ e8b2b9e
10
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
SSRF: 6 prior fixes. Scrutinize any change in this area.
pkg/v1/remote/transport/bearer.go: most-fixed (4 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SSRF: The client library is highly susceptible to SSRF because it fetches OCI layers, handles pagination Link headers, and downloads foreign layers. Malicious registries can redirect requests to local, loopback, or private networks if redirects are not strictly validated.
Information Disclosure: During cross-host HTTP redirects, bearer tokens authenticated for a specific registry can be leaked to malicious third-party hosts if host matching checks are omitted or bypassed.
SSRF: The realm URL returned in WWW-Authenticate headers or redirect targets can be manipulated to point to loopback (including 0.0.0.0 or ::) or local private networks, leading to SSRF during token-fetch requests.