GHSA-77vh-xpmg-72qh:
Clarify `mediaType` handling
3
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/opencontainers/image-spec | go | < 1.0.2 | 1.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from structural ambiguity in OCI document parsing rather than specific functions. The core issue is the absence of mandatory mediaType field in Index and Manifest structs in versions <1.0.2, leading to type confusion during deserialization. While the specs-go/v1/index.go and manifest.go struct definitions were modified to add MediaType fields, these are data structures rather than functions. The actual parsing vulnerability would manifest in JSON unmarshaling logic that processes these structs, but this is typically handled by Go's standard library encoding/json package rather than specific functions in the image-spec codebase. No specific functions in the package's code could be identified with high confidence as vulnerable entry points.