Go/github.com/notaryproject/notation CVE-2024-23332: medium 4, EPSS 0.29%
Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-57wx-m636-g3g8
- https://github.com/notaryproject/specifications/security/advisories/GHSA-57wx-m636-g3g8
- https://nvd.nist.gov/vuln/detail/CVE-2024-23332
- https://github.com/notaryproject/specifications/commit/cdabdd1042de2999c685fa5d422a785ded9c983a
- https://github.com/notaryproject/specifications
CVE-2024-23332 · published · modified · JSON