PT-2024-39992 · Regclient · Regclient

Sudo-Bmitch · Published 2024-08-05 · Updated 2025-01-29 · CVE-2025-24882

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions regclient versions prior to 0.7.1

Description A malicious registry could return a different digest for a pinned manifest without detection. This issue affects the regclient, a Docker and OCI Registry Client in Go.

Recommendations For versions prior to 0.7.1, update to version 0.7.1 to resolve the issue. As a temporary workaround, after running a regclient.ManifestGet, compare the returned digest to the requested digest to detect any discrepancies.

Exploit

Fix

Insufficient Verification of Data Authenticity

RCE

Weakness Enumeration

CWE-345

CWE-20

Related Identifiers

CVE-2025-24882

GHSA-QV35-3GW6-8Q4J

GO-2024-3038

Affected Products

Regclient

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24882.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-24882 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qv35-3gw6-8q4j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24882 · Security Note
• https://osv.dev/vulnerability/GO-2024-3038 · Vendor Advisory
• https://github.com/regclient/regclient/commit/7d17cff26c22196b5ddd66bda8c5ee4abf3d1269 · Note
• https://github.com/regclient/regclient/security/advisories/GHSA-qv35-3gw6-8q4j · Note
• https://github.com/regclient/regclient · Note
• https://t.me/cvedetector/16702 · Telegram Post
• https://twitter.com/CVEnew/status/1884660450798780676 · Twitter Post
• https://pkg.go.dev/vuln/GO-2024-3038 · Note