Yüksek CVSS 7.5 PoC var
CVE-2026-50151: Oras: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
Özet bilgiler
- Ürün
- Linuxfoundation Oras
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %0,38 (yüzdelik 32)
- CWE
- CWE-918
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linuxfoundation-oras | — | — | 2.6.1 |