x/vulndb: potential Go vuln in github.com/docker/distribution: GHSA-qq97-vm5h-rrhg

[GoVulnBot]

In GitHub Security Advisory GHSA-qq97-vm5h-rrhg, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/docker/distribution	2.8.0	< 2.8.0

See doc/triage.md for instructions on how to triage this report.

package: github.com/docker/distribution
versions:
  - introduced: v0.0.0
    fixed: v2.8.0
description: "### Impact\n\nSystems that rely on digest equivalence for image attestations
    may be vulnerable to type confusion.\n\n### Patches\n\nUpgrade to at least `v2.8.0-beta.1`
    \ if you are running `v2.x` release. If you use the code from the `main` branch,
    update at least to the commit after [b59a6f827947f9e0e67df0cfb571046de4733586](https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586).\n\n###
    Workarounds\n\nThere is no way to work around this issue without patching.\n\n###
    References\n\nDue to [an oversight in the OCI Image Specification](https://github.com/opencontainers/image-spec/pull/411)
    that removed the embedded `mediaType` field from manifests, a maliciously crafted
    OCI Container Image can cause registry clients to parse the same image in two
    different ways without modifying the image’s digest by modifying the `Content-Type`
    header returned by a registry. This can invalidate a common pattern of relying
    on container image digests for equivalence.\n\n### For more information\n\nIf
    you have any questions or comments about this advisory:\n* Open an issue in [distribution](https://github.com/distribution/distribution)
    \n* Open an issue in [distribution-spec](https://github.com/opencontainers/distribution-spec)
    \n* Email us at [cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io)\n"
published: 2022-02-08T18:53:56Z
last_modified: 2022-02-11T22:32:05Z
ghsas:
  - GHSA-qq97-vm5h-rrhg

[gopherbot]

Change https://go.dev/cl/416557 mentions this issue: x/vulndb: add reports/GO-2022-0379.yaml for GHSA-qq97-vm5h-rrhg