ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go

Description

References

• oras-project/oras-go security advisory · ADVISORY
• oras-project/oras-go commit 3c2e884 · FIX
• oras-project/oras-go release v2.6.1 · WEB

oras.land/oras-go/v2 的其他漏洞

• CVE-2026-85732中危 4.7oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute U…
• CVE-2026-85731高危 8.8oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.con…
• CVE-2026-50163高危 7.1oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink tar…
• CVE-2026-50162中危 6.9oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel c…
• CVE-2026-50151高危 7.5oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost …