GHSA-qq97-vm5h-rrhg

Low

Advisory

Published 8 Feb 2022In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 3.0; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 181; of 17,781 indexed, latest versions
Container images: 162; deployed by those charts
Fix available: 1 of 1; affected package

Type confusion in github.com/docker/distribution

Carried by container images the latest versions of 181 of 17,781 indexed charts deploy, on 162 images.

Affected package	Affected versions	Fixed in	Images
github.com/docker/distributiongolang	v0.0.0-20171011171712-7484e51bf6af, v0.0.0-20191216044856-a8371794149d, v0.0.0-20260602055908-11540eae06cb+dirty, v0.0.0-20260701071724-493dca9a81a8+dirty+5 more	2.8.0, 2.8.0+incompatible	162

OSV records: GHSA-qq97-vm5h-rrhg GO-2022-0379

Charts affected

181 by stars

Chart

Latest

Affected images

Radar Score

gitlab-operatorrock8s

0.7.0

1 of 2 See more

gitlab-operator rock8s 0.7.0

1 of the 2 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

5,422

argocdromholdings

1.8.1

1 of 3 See more

argocd romholdings 1.8.1

1 of the 3 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
argoproj/argocd :v1.8.1	830e86cacefd	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

10,466

clairromholdings

0.1.14

1 of 2 See more

clair romholdings 0.1.14

1 of the 2 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/devtron/clair :4.3.6	75fb847ac045	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

6,237

devtron-enterpriseromholdings

48.0.0

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

68,240

kube-prometheus-stackromholdings

19.3.0

1 of 6 See more

kube-prometheus-stack romholdings 19.3.0

1 of the 6 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-operator :v0.50.0	ab4f480f2cc6	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

8,645

securityromholdings

0.2.2

1 of 1 See more

security romholdings 0.2.2

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/devtron/image-scanner :b278f42b-334-11119	88c64b1b6ec8	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

2,435

ed-traefikscaleway-charts

0.2.0

1 of 1 See more

ed-traefik scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
library/traefik :v1.7.34	5d47b7bb2546	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

2,133

ed-traefik2scaleway-charts

0.2.0

1 of 1 See more

ed-traefik2 scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
library/traefik :2.5.6	2f603f8d3abe	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

3,160

centralbrainsciencemesh

0.0.3

1 of 5 See more

centralbrain sciencemesh 0.0.3

1 of the 5 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.22.1	b899dbd1b901	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

9,754

metrics-generatorsikalabs

0.2.0

1 of 1 See more

metrics-generator sikalabs 0.2.0

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
sikalabs/slu :v0.34.0	fdc0c6711add	github.com/docker/distribution@v0.0.0-20171011171712-7484e51bf6af	2.8.0

Open the chart page →

2,381

flux-notifierslamdev

0.0.7

1 of 1 See more

flux-notifier slamdev 0.0.7

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
slamdev/flux-notifier :v0.0.8	b173d809132d	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

2,015

gitlab-runnerslamdev

0.0.1

1 of 1 See more

gitlab-runner slamdev 0.0.1

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
gitlab/gitlab-runner :v15.3.0	860d4a3fec7a	github.com/docker/distribution@v2.7.0+incompatible	2.8.0

Open the chart page →

9,196

gloo-meshsolo-gloo-mesh

1.1.2

1 of 1 See more

gloo-mesh solo-gloo-mesh 1.1.2

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
gcr.io/gloo-mesh/gloo-mesh :1.1.2	a4011eae6a0b	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

3,257

testing-multitoolsomeblackmagic

0.1.2

1 of 1 See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

30,687

allurestakater

1.0.1

1 of 1 See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

28,165

cost-analyzerstatcan

1.82.2

2 of 9 See more

cost-analyzer statcan 1.82.2

2 of the 9 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.22.2	f7ffebdd428b	github.com/docker/distribution@v2.7.1+incompatible	2.8.0
gcr.io/kubecost1/server :prod-1.82.2	2b1a3d08caac	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

16,506

taalhuizen-servicetaalhuizen-service

1.0.0

1 of 3 See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,480

telegraf-ds-k3stelegraf-ds-k3s

1.0.0

1 of 1 See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
library/telegraf :1.19.0-alpine	794079a7f241	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

3,764

temporaltemporal

0.28.9

1 of 13 See more

temporal temporal 0.28.9

1 of the 13 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

21,005

monitoringthl-charts

0.1.1

2 of 10 See more

monitoring thl-charts 0.1.1

2 of the 10 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
grafana/promtail :2.4.2	626900031c4e	github.com/docker/distribution@v2.7.1+incompatible	2.8.0
quay.io/prometheus/prometheus :v2.34.0	b37103e03399	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

18,908

trouw-servicetrouw-service

1.0.0

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,510

verhuis-serviceverhuis-service

1.0.0

1 of 3 See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,510

verzoekconversieserviceverzoekconversieservice

1.0.0

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,528

verzoekregistratiecomponentverzoekregistratiecomponent

1.1.0

1 of 4 See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,429

verzoektypecatalogusverzoektypecatalogus

1.1.0

1 of 4 See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,429

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

5,484

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

11,119

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	github.com/docker/distribution@v0.0.0-20191216044856-a8371794149d	2.8.0

Open the chart page →

7,552

harborwenerme

1.19.2

2 of 8 See more

harbor wenerme 1.19.2

2 of the 8 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
goharbor/harbor-registryctl :v2.15.2	223d5cb49d5d	github.com/docker/distribution@v0.0.0-20260701071724-493dca9a81a8+dirty	2.8.0
goharbor/registry-photon :v2.15.2	c4ebef61ceb5	github.com/docker/distribution@v0.0.0-20260701071724-493dca9a81a8+dirty	2.8.0

Open the chart page →

1,650

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

15,230

traefikwenerme

9.1.1

1 of 1 See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry GHSA-qq97-vm5h-rrhg.

Container image	Digest	Package	Fixed in
library/traefik :2.2.8	f5af5a5ce17f	github.com/docker/distribution@v2.7.1+incompatible	2.8.0

Open the chart page →

3,369

Container images carrying it

162 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/openshift/origin-cli :4.6	6722d5041b47	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/prometheus-operator/prometheus-operator :v0.54.0	be2aef39a2f8	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/prometheus/prometheus :v2.39.1	4748e26f9369	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/prometheus/prometheus :v2.37.0	56e7f18e05dd	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/prometheus/prometheus :v2.34.0	b37103e03399	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	github.com/docker/distribution@v2.7.1+incompatible github.com/docker/distribution@v2.7.1+incompatible	2.8.0+incompatible 2.8.0	1