Notary Project notation-go 1.0.0 Release Candidate 2
Approved changes feed: RSS · Atom
cpe:2.3:a:notaryproject:notation-go:1.0.0:rc2:*:*:*:*:*:*
part: a version: 1.0.0 update: rc2
| Vendor | Notaryproject (cd82ac48-cd9e-5e68-88f1-4dc71808db05) |
|---|---|
| Product | Notation Go (882d2ca5-fbfa-5719-a0c8-69b44260bf06) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/notaryproject/specifications |
purl2cpe | 2026-06-01 10:12:04.171909 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-33959 |
vulnerable | 2026-06-08 06:06:24.078071 |
Verification bypass can cause users into verifying the wrong artifact
HIGH (8.4)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:15:14.317Z
Updated: 2024-08-02T15:54:14.191Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33958 |
vulnerable | 2026-06-08 06:06:24.077518 |
Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
MEDIUM (5.4)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:13:16.926Z
Updated: 2024-08-02T15:54:14.098Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33957 |
vulnerable | 2026-06-08 06:06:24.074742 |
Denial of service from high number of artifact signatures in notation
LOW (2.6)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:10:30.416Z
Updated: 2024-08-02T15:54:14.164Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.