Approved changes feed: RSS · Atom

cpe:2.3:a:notaryproject:notation:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorNotaryproject (cd82ac48-cd9e-5e68-88f1-4dc71808db05)
ProductNotation (f41c26b6-3e4b-54f2-852d-369ea39b11a1)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/notaryproject/notation purl2cpe 2026-06-01 10:12:04.177699
pkg:golang/github.com/notaryproject/notation purl2cpe 2026-06-01 10:12:04.177702

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-33958 vulnerable 2026-06-08 06:06:24.077323 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
MEDIUM (5.4)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:13:16.926Z
Updated: 2024-08-02T15:54:14.098Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-33957 vulnerable 2026-06-08 06:06:24.072378 Denial of service from high number of artifact signatures in notation
LOW (2.6)
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Published: 2023-06-06T18:10:30.416Z
Updated: 2024-08-02T15:54:14.164Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.