| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/chainguard-dev/bincapz | ≥ 0.10.0 | |
| github.com/chainguard-dev/malcontent | ≥ 0.10.0, < 1.20.3< 1.20.3 | 1.20.3 |
| malcontent | ≥ 0.1.0, < 1.20.3 | 1.20.3 |
Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a WWW-Authenticate header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint.
Fix: Default to anonymous auth for OCI pulls
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free