Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

deislabs/oras

              main @ 71d17dd
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Credential Exposure / Client Certificate Leak: 1 prior fix. Scrutinize any change in this area.

cmd/oras/internal/option/remote.go: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Credential Exposure / Client Certificate Leak: Client certificates were reused across all TLS peers, leaking credentials to non-registry origins.

Sensitive Data Exposure via Header Leak: Custom headers like X-API-Key were appended to all requests, potentially leaking secrets to unintended endpoints.

Path Traversal / Symlink Attack: Tar extraction wrote files via symlink paths, enabling path traversal and arbitrary file write.