Approved changes feed: RSS · Atom
cpe:2.3:a:notaryproject:notation:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Notaryproject (cd82ac48-cd9e-5e68-88f1-4dc71808db05) |
|---|---|
| Product | Notation (f41c26b6-3e4b-54f2-852d-369ea39b11a1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/notaryproject/notation |
purl2cpe | 2026-06-01 10:12:04.177699 |
pkg:golang/github.com/notaryproject/notation |
purl2cpe | 2026-06-01 10:12:04.177702 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-33958 |
vulnerable | 2026-06-08 06:06:24.077323 |
Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
MEDIUM (5.4)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:13:16.926Z
Updated: 2024-08-02T15:54:14.098Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33957 |
vulnerable | 2026-06-08 06:06:24.072378 |
Denial of service from high number of artifact signatures in notation
LOW (2.6)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:10:30.416Z
Updated: 2024-08-02T15:54:14.164Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.