CyberRota Analysis
AI-GeneratedThe oras-go library prior to version 2.6.1 is vulnerable due to improper handling of the Location header during blob uploads, which allows a malicious registry to redirect requests and capture user credentials. This poses a significant risk as it can lead to unauthorized access and data breaches. Organizations using this library should prioritize upgrading to version 2.6.1 to mitigate the risk of credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.