Notation-go vulnerabilities

2 known vulnerabilities in Notation-go from Notaryproject. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  notation-go: Improper Verification of Cryptographic Signature

  CVE-2023-33959Jun 6, 2023Notaryproject

  notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go

• 7.5 High severity

  notation-go: Allocation of Resources Without Limits or Throttling

  CVE-2023-25656Feb 20, 2023Notaryproject

  notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be