Skip to content
OpenAdvisories

Vendor

notaryproject

7 known vulnerabilities.

Products

notation-go 4 notation 2 specifications 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.0
    CVE-2024-56138

    Timestamp signature generation lacks certificate revocation check in notion-go

    notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation…

    notaryproject notation-go flux-source-controller kyverno-notation-aws Debian Ubuntu Wolfi Go
  • Medium 4.0
    CVE-2024-23332

    Client configured with permissive trust policies susceptible to rollback attack in Notary Project

    The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container re…

    notaryproject specifications xeol github.com/notaryproject/notation Wolfi Go
  • Medium 5.4
    CVE-2023-33958

    Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

    notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verif…

    notaryproject notation github.com/notaryproject/notation Go