How it was found

An image hash is publicly exposed on Github

Steps to reproduce: See at >> https://github.com/curl/curl/blob/master/Dockerfile

Solution:

If you want to keep the hash, the repository should be private

#Use official tags without specific hashes or environment variables

Best, @skymander

Impact

An attacker can use this hash to:

• View known vulnerabilities
• View your deployment environment

2. Complete URLs

• Expose your internal infrastructure
• Private repositories
• Specific endpoints