github.com/slsa-framework/slsa-verifier

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

Low —

GHSA-r2xv-vpr2-42m9

slsa-verifier vulnerable to mproper validation of npm's publish attestations

### Summary `slsa-verifier<=2.4.0` does not correctly verify npm's [publish](https://github.com/npm/attestation/tree/main/specs/publish/v0.1) attestations signature. ### Proof of concept Steps to reproduce: 1. `curl -Sso attestations.json $(npm view @trishank…

github.com/slsa-framework/slsa-verifier github.com/slsa-framework/slsa-verifier/v2 Go

Nov 8, 2023