GO-2022-0379

    Dashboard / Vulnerabilities / GO-2022-0379

    GO-2022-0379

    Published: 29 Jul 2022Last Modified: 7 Aug 2026

    Summary: Type confusion in github.com/docker/distribution

    Details: Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. A maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image's digest, invalidating the common pattern of relying on container image digests for equivalence. This problem has been addressed in newer versions by improving validation in manifest unmarshalling.

    References: https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586

    Affected packages

    Package

    Name: github.com/docker/distribution

    Purl: pkg:golang/github.com/docker/distribution

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -2.8.0+incompatible

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2022-0379 | CVE-DB