CVE-2025-24882 - Vulnerability Details - OpenCVE

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://github.com/regclient/regclient
https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269
https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j
https://nvd.nist.gov/vuln/detail/CVE-2025-24882
https://www.cve.org/CVERecord?id=CVE-2025-24882

History

Thu, 13 Feb 2025 00:45:00 +0000

Type	Values Removed	Values Added
References		https://github.com/regclient/regclient https://nvd.nist.gov/vuln/detail/CVE-2025-24882 https://www.cve.org/CVERecord?id=CVE-2025-24882
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 29 Jan 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Jan 2025 17:45:00 +0000

Type	Values Removed	Values Added
Description		regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.
Title		regclient may ignore pinned manifest digests
Weaknesses		CWE-20 CWE-345
References		https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269 https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j
Metrics		cvssV3_1 `{'score': 5.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-01-29T17:40:07.496Z

Updated: 2025-01-29T17:52:45.827Z

Reserved: 2025-01-27T15:32:29.449Z

Link: CVE-2025-24882

Vulnrichment

Updated: 2025-01-29T17:47:29.251Z

NVD

Status : Received

Published: 2025-01-29T18:15:47.570

Modified: 2025-01-29T18:15:47.570

Link: CVE-2025-24882

Redhat

Severity : Moderate

Publid Date: 2024-08-04T00:00:00Z

Links: CVE-2025-24882 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-01-27T15:32:29.449Z", "datePublished": "2025-01-29T17:40:07.496Z", "dateUpdated": "2025-01-29T17:52:45.827Z"}, "containers": {"cna": {"title": "regclient may ignore pinned manifest digests", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j"}, {"name": "https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269", "tags": ["x_refsource_MISC"], "url": "https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269"}], "affected": [{"vendor": "regclient", "product": "regclient", "versions": [{"version": "< 0.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-29T17:40:07.496Z"}, "descriptions": [{"lang": "en", "value": "regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1."}], "source": {"advisory": "GHSA-qv35-3gw6-8q4j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-29T17:52:40.596309Z", "id": "CVE-2025-24882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-29T17:52:45.827Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-29T17:52:40.596309Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-29T17:47:29.251Z"}}], "cna": {"title": "regclient may ignore pinned manifest digests", "source": {"advisory": "GHSA-qv35-3gw6-8q4j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "regclient", "product": "regclient", "versions": [{"status": "affected", "version": "< 0.7.1"}]}], "references": [{"url": "https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j", "name": "https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269", "name": "https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-29T17:40:07.496Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24882", "state": "PUBLISHED", "dateUpdated": "2025-01-29T17:52:45.827Z", "dateReserved": "2025-01-27T15:32:29.449Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-29T17:40:07.496Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}