Distribution: Client `manifests.Get()` does not verify returned content against requested digest
影響: go:github.com/docker/distribution <= 2.8.3, go:github.com/distribution/distribution/v3 < 3.1.2 → 3.1.2
registry/client.(manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pu…
| CVE | CVE-2026-85747 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 16. 오전 05:22, GitHub Advisory Database에서 "Distribution: Client `manifests.Get()` does not verify returned content against requested digest"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub, Docker. CVE: CVE-2026-85747.