CVE-2024-23332: GO-2024-2472 - Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compr

CVE-2024-23332 · Severity: low · CVSS 3.1 · Published 2024-06-28

Technologies: github.com/notaryproject/notation (Go). Vendors: Go.

Executive brief

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

Affected products

Go github.com/notaryproject/notation

Related threats

GO-2023-1829 - Notation vulnerable to denial of service from high number of artifact signatures in github.com/notaryproject/notation
GO-2023-1831 - Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack in github.com/notaryproject/notation