-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/distribution/distribution/v3 | go | > 3.0.0-beta.1, < 3.0.0-rc.3 | 3.0.0-rc.3 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the original implementation of verifyJWK in token.go. The pre-patch code: 1) Directly used jwk.Key from the header, 2) Only checked if the kid existed in TrustedKeys map, 3) Returned the untrusted JWK key material when no certificate chain was present. The commit diff shows the fix changes this to retrieve the key from TrustedKeys using the kid, ensuring the actual trusted key is used for verification. The added test TestVerifyJWKWithTrustedKey in token_test.go validates this behavior change, confirming the vulnerability existed in verifyJWK.
Ongoing coverage of React2Shell