TI-2024-37131 Aliases CVE-2024-56138 GHSA-45v3-38pc-874v

Timestamp signature generation lacks certificate revocation check in notion-go

LOW 18CWE-299Published 2025-01-13 · Updated 2025-01-14

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00132 2nd percentileScored 2026-11-07

Fix Fixed notation-go (notaryproject): 1.3.0-rc.2github.com/notaryproject/notation-go (Go): 1.3.0-rc.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
notaryproject	notation-go	before 1.3.0-rc.2	1.3.0-rc.2	Patch available	CNA
—	github.com/notaryproject/notation-go (Go)	1.2.0-beta.1 to before 1.3.0-rc.2	1.3.0-rc.2	Patch available	GHSA-45v3-38pc-874v

notation-go Vendornotaryproject Affected before 1.3.0-rc.2 Fixed in 1.3.0-rc.2 Patch available CNA
github.com/notaryproject/notation-go (Go) Vendor— Affected 1.2.0-beta.1 to before 1.3.0-rc.2 Fixed in 1.3.0-rc.2 Patch available GHSA-45v3-38pc-874v

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:notaryproject:notation-go::::::::	—	—	notaryproject

cpe:2.3:a:notaryproject:notation-go:*:*:*:*:*:*:*:* Versions — — ·notaryproject

Remediation

Fix · CNA notation-go (notaryproject) Fixed in 1.3.0-rc.2
Fix · GHSA-45v3-38pc-874v github.com/notaryproject/notation-go (Go) Fixed in 1.3.0-rc.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-56138
2026-10-03 Alias added: GHSA-45v3-38pc-874v

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-56138

Other 5

TI-2024-34412 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go CVSS 3.1LOW 3.3
TI-2023-10937 notation-go has excessive memory allocation on verification CVSS 3.1HIGH 7.5
TI-2023-16827 Verification bypass can cause users into verifying the wrong artifact CVSS 3.1HIGH 8.8
TI-2024-15434 Client configured with permissive trust policies susceptible to rollback attack in Notary Project CVSS 3.1MEDIUM 6.8
TI-2023-16826 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation CVSS 3.1MEDIUM 6.5
TI-2023-16825 Denial of service from high number of artifact signatures in notation CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences