Skip to content
OpenAdvisories

Package · Go

github.com/notaryproject/notation

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.0
    CVE-2024-23332

    Client configured with permissive trust policies susceptible to rollback attack in Notary Project

    The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container re…

    notaryproject specifications github.com/notaryproject/notation Go
  • Medium 5.4
    CVE-2023-33958

    Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

    notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verif…

    notaryproject notation github.com/notaryproject/notation Go