Vulnerabilities

TI-2024-34412 CVE-2024-51491 · GHSA-qjh3-4j3h-vmwp

Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go

MEDIUM 49

notion-go is a collection of libraries for supporting sign and verify OCI artifacts.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00196 Published 2025-01-13 Fixed in 1.3.0-rc.2 CWE-703

TI-2024-15434 CVE-2024-23332 · GHSA-57wx-m636-g3g8

Client configured with permissive trust policies susceptible to rollback attack in Notary Project

LOW 30

The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.0029 Published 2024-01-19 No fix listed CWE-672

TI-2023-16827 CVE-2023-33959 · GHSA-xhg5-42rf-296r

Verification bypass can cause users into verifying the wrong artifact

LOW 38

notation is a CLI tool to sign and verify OCI artifacts and container images.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00354 Published 2023-06-06 Fixed in 1.0.0-rc.6 CWE-347

TI-2023-16826 CVE-2023-33958 · GHSA-rvrx-rrwh-r9p6

Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

LOW 29

notation is a CLI tool to sign and verify OCI artifacts and container images.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00485 Published 2023-06-06 Fixed in 1.0.0-rc.6 CWE-400

TI-2023-16825 CVE-2023-33957 · GHSA-9m3v-v4r5-ppx7

Denial of service from high number of artifact signatures in notation

LOW 26

notation is a CLI tool to sign and verify OCI artifacts and container images.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00506 Published 2023-06-06 Fixed in 1.0.0-rc.6 CWE-400

TI-2023-10937 CVE-2023-25656 · GHSA-87x9-7grx-m28v

notation-go has excessive memory allocation on verification

LOW 39

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0044 Published 2023-02-20 Fixed in 1.0.0-rc.3 CWE-770

Vulnerabilities

Filters

Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go

Client configured with permissive trust policies susceptible to rollback attack in Notary Project

Verification bypass can cause users into verifying the wrong artifact

Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

Denial of service from high number of artifact signatures in notation

notation-go has excessive memory allocation on verification