Skip to content
OpenAdvisories

Package · Maven

land.oras:oras-java-sdk

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    GHSA-xm96-gfjx-jcrc

    ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

    ### Summary The `pullArtifact` methods in `Registry` and `OCILayout` use the `org.opencontainers.image.title` annotation from a pulled manifest as a filename, resolving it against the caller supplied output directory without normalization or a containment che…

    land.oras:oras-java-sdk Maven