Oras
Monthly
Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither `fetchAllReferrers` in the discover path nor `RecursiveFindReferrers` in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. No public exploit has been identified at time of analysis, though the fix commit and its accompanying regression tests make the attack pattern trivially reproducible. A patched release, version 1.3.3, is available.
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither `fetchAllReferrers` in the discover path nor `RecursiveFindReferrers` in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. No public exploit has been identified at time of analysis, though the fix commit and its accompanying regression tests make the attack pattern trivially reproducible. A patched release, version 1.3.3, is available.
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.