GHSA-xhg5-42rf-296rHighCVSS 8.8

notation-go's verification bypass can cause users to verify the wrong artifact

Published
June 6, 2023
Last Modified
November 8, 2023

🔗 CVE IDs covered (1)

CVE-2023-33959 →

📋 Description

Impact

An attacker who controls or compromises a registry can lead a user to verify the wrong artifact.

Patches

The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above.

Workarounds

User should use secure and trusted container registries.

Credits

The notation project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi) for root cause analysis.

🎯 Affected products1

  • go/github.com/notaryproject/notation-go:< 1.0.0-rc.6

🔗 References (6)