tocsin

Debian/golang-oras-oras-go: medium 4.7

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without v

Action: Upgrade golang-oras-oras-go to 2.6.2-1 or later.

Affected

introducedfixedlast affected
02.6.2-1-

Fixed versions

2.6.2-1

Sources

published · modified · JSON