Skip to main content
cve.nowby Sazabi
← Go
GoPackage

zotregistry.dev/zot

5 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 3 high, 2 medium
Registry
pkg.go.dev

Advisories 5

  • zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

    Affected: all versions.

  • zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

    Affected: from 1.3.0-20210831063041-c8779d9e87d9, through 1.4.4-20251014054906-73eef25681af; all versions.

  • CVE-2025-48374Medium 5.5

    zot logs secrets

    Affected: fixed in 1.4.4-0.20250522160828-8a99a3ed231f.

  • IdP group membership revocation ignored in zot

    Affected: all versions; fixed in 2.1.2.

  • CVE-2024-39897Medium 4.3

    Cache driver GetBlob() allows read access to any blob without access control check

    Affected: fixed in 2.1.0; all versions.