notation-go

4 results · Feed

• Low 3.3
  CVE-2024-51491

  Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go

  notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab's security audit on the Certificate Revocation List (CRL) based revocation check feature. Af…

  notaryproject notation-go github.com/notaryproject/notation-go golang-github-notaryproject-notation Ubuntu Go
  Jan 13, 2025
• Medium 4.0
  CVE-2024-56138

  Timestamp signature generation lacks certificate revocation check in notion-go

  notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation…

  notaryproject notation-go github.com/notaryproject/notation-go golang-github-notaryproject-notation Debian Ubuntu Go
  Jan 13, 2025
• High 8.4
  CVE-2023-33959

  Verification bypass can cause users into verifying the wrong artifact

  notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-g…

  notaryproject notation-go github.com/notaryproject/notation-go Go
  Jun 6, 2023
• High 7.5
  CVE-2023-25656

  notation-go has excessive memory allocation on verification

  notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will b…

  notaryproject notation-go github.com/notaryproject/notation-go Go
  Feb 20, 2023