Database/Container, Kubernetes & orchestration
OCI Distribution Spec: Content-Type alone determines manifest type, so a manifest can be interpreted differently
CVE-2021-41190Container, Kubernetes & orchestrationcurated
Impact
Content-Type alone determines manifest type, so a manifest can be interpreted differently by different clients; signature and policy confusion
Who can reach it
Malicious image in any registry
What to do
Upgrade registry and client tooling; pin by digest rather than tag
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.