Vulnerability Report: GO-2023-1832
- CVE-2023-33959, GHSA-xhg5-42rf-296r
- Affects: github.com/notaryproject/notation-go
- Published: Jun 26, 2023
An attacker who controls or compromises a registry can lead a user to verify the wrong artifact.
For detailed information about this vulnerability, visit https://github.com/notaryproject/notation-go/security/advisories/GHSA-xhg5-42rf-296r.
Affected Packages
-
PathVersionsSymbols
-
before v1.0.0-rc.6
Aliases
References
- https://github.com/notaryproject/notation-go/security/advisories/GHSA-xhg5-42rf-296r
- https://github.com/notaryproject/notation-go/commit/39c8ed050a65cca3f3f308534acb612096735a64
- https://github.com/notaryproject/notation-go/commit/eba60f5aed9c9e05dee55324423c95fe34700b4c
- https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6
- https://vuln.go.dev/ID/GO-2023-1832.json
Credits
- Adam Korczynski (@AdamKorcz)Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.