Threats affecting pkg:cargo/ocipkg

The Rust crate 'ocipkg' has been declared unmaintained by its author, with version 0.4.1 as the final release. No further updates, including security fixes, will be provided. Users requiring similar functionality are advised to use the 'oci-client' from the ORAS project for OCI registry interactions or to fork and maintain 'ocipkg' themselves for specific features not covered by 'oci-client'.

The `ocipkg` tool has a path traversal vulnerability when unpacking OCI archives. The destination directory for unpacking is derived from an attacker-controlled image name read from the archive's own index.json. This allows escaping the intended local image store directory, enabling deletion and writing of files outside the store. The flaw is fixed in version 0.4.1 by validating and sanitizing the image name to prevent path traversal.