Vulnerability in github.com/opencontainers/distribution-spec (CVE-2021-41190)

Summary

Vulnerability in github.com/opencontainers/distribution-spec (CVE-2021-41190). Risk of unauthorized operations or information disclosure. Exploitable via mediaType. Mitigation: upgrade to 1.0.1 or later.

Original description

The description as published by the source.

Impact

In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

Patches

The OCI Distribution Specification will be updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations.

Workarounds

Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

References

https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/opencontainers/distribution-spec/
Email us at security@opencontainers.org

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-41190 has been found in github.com/opencontainers/distribution-spec.
Attackers can target a specific entry point like mediaType over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade github.com/opencontainers/distribution-spec to 1.0.1 or later.
If unsure, ask your IT team or search "github.com/opencontainers/distribution-spec CVE-2021-41190" on the vendor's site.

CVE-2021-41190 (github.com/opencontainers/distribution-spec) — CWE-843
Attack vector: remote (network-reachable)
Attack surface: mediaType
Patched: 1.0.1 — apply immediately
Workaround: Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-843) exists in github.com/opencontainers/distribution-spec. Attackers reach the vulnerable code path via mediaType.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/opencontainers/distribution-spec. Attack surface: mediaType.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 1.0.1.

🛡️ Workaround

Workaround: Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/opencontainers/distribution-spec' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'github.com/opencontainers/distribution-spec' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/opencontainers/distribution-spec を grep し、稼働しているサービス・バージョンを把握する。
2
Apply temporary workaround mitigate
```
Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.
```
パッチが適用されるまでの応急処置として、Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields. を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade github.com/opencontainers/distribution-spec to 1.0.1
```
ステージング環境で 1.0.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Go github.com/opencontainers/distribution-spec

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Ubuntu UBUNTU-CVE-2021-41190 docker.io