Skip to content
OpenAdvisories

Package · Maven

land.oras:oras-java-sdk

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • None 0.0
    GHSA-j6hm-v3x2-qv6j

    land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

    ### Summary `ArchiveUtils.untar(InputStream, Path)` and `ArchiveUtils.unzip(InputStream, Path)` in `land.oras:oras-java-sdk` create symbolic-link entries from an archive without validating the symlink target. A malicious tar (or zip) shipped as an OCI layer b…

    land.oras:oras-java-sdk Maven
  • High 8.1
    GHSA-xm96-gfjx-jcrc

    ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

    ### Summary The `pullArtifact` methods in `Registry` and `OCILayout` use the `org.opencontainers.image.title` annotation from a pulled manifest as a filename, resolving it against the caller supplied output directory without normalization or a containment che…

    land.oras:oras-java-sdk Maven