What is GHSA-qv35-3gw6-8q4j?

GHSA-qv35-3gw6-8q4j is a security advisory published by GitHub Security Advisories with Medium severity. In regclient, pinned manifest digests may be ignored

Which CVE IDs does GHSA-qv35-3gw6-8q4j cover?

GHSA-qv35-3gw6-8q4j covers the following CVE IDs: CVE-2025-24882. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qv35-3gw6-8q4j?

GHSA-qv35-3gw6-8q4j has a CVSS v3 base score of 5.2, published by GitHub Security Advisories.

Which products are affected by GHSA-qv35-3gw6-8q4j?

GHSA-qv35-3gw6-8q4j affects 1 product, including: go/github.com/regclient/regclient:\u003c 0.7.1.

GHSA-qv35-3gw6-8q4jMediumCVSS 5.2

In regclient, pinned manifest digests may be ignored

Vendor

GitHub Security Advisories

Published

August 5, 2024

Last Modified

January 29, 2025

🔗 CVE IDs covered (1)

CVE-2025-24882 →

📋 Description

Impact

A malicious registry could return a different digest for a pinned manifest without detection.

Patches

This has been fixed in the v0.7.1 release.

Workarounds

After running a regclient.ManifestGet, the returned digest can be compared to the requested digest.

🎯 Affected products1

go/github.com/regclient/regclient:< 0.7.1

🔗 References (5)

https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j
https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269
https://pkg.go.dev/vuln/GO-2024-3038
https://nvd.nist.gov/vuln/detail/CVE-2025-24882
https://github.com/advisories/GHSA-qv35-3gw6-8q4j