deislabs vulnerabilities

Products

• github.com/deislabs/oras 1
• github.com/deislabs/ratify 1

Latest deislabs CVEs

Newest publication first

1. CVE-2025-27403 Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

   Published 2025-03-11

   High·CVSS 7.2 EPSS 0.48%

   Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment, Ratify can be configured to authenticate...

2. CVE-2021-21272 zip slip in ORAS

   Published 2021-01-25

   High·CVSS 7.7 EPSS 1.5%

   ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature all...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.