RSS   Vulnerabilities for
'Open container initiative distribution specification'
   RSS

2021-11-17
 
CVE-2021-41190

CWE-843
 

 
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both �??manifests�?� and �??layers�?� fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both �??manifests�?� and �??layers�?� fields or �??manifests�?� and �??config�?� fields if they are unable to update to version 1.0.1 of the spec.

 

 >>> Vendor: Linuxfoundation 32 Products
Foomatic
Cups-filters
XEN
Foomatic-filters
Open network operating system
RUNC
The update framework
DOJO
Dojox
Argo continuous delivery
CEPH
Free range routing
Jaeger
Osquery
Harbor
ACRN
Nats-server
Containerd
Spinnaker
DEX
Indy-node
BESU
Argo-cd
Umoci
Grpc swift
Cortex
Backstage
Open container initiative distribution specification
Open container initiative image format specification
Fabric
Auth backend
Kubeedge


Copyright 2024, cxsecurity.com

 

Back to Top