Overview
- Description
- notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
Weaknesses
- security-advisories@github.com
- CWE-347
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E048A2E7-0021-480A-AD91-F07F8BFDE9CE",
"versionEndExcluding": "1.0.0"
},
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:1.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6851C33-6C20-4B20-B26F-E258C681265E"
},
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:1.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99878E6C-4778-4ECE-9E29-D2A1AFB9DB82"
},
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:1.0.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B583E52-5510-42E2-AD05-F574ACCB13E3"
},
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:1.0.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C23C91C1-C4D1-47AC-B167-CCFF71A00C5B"
},
{
"criteria": "cpe:2.3:a:notaryproject:notation-go:1.0.0:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB72FE70-F2E3-4540-A6BE-2EE0DB662365"
}
],
"operator": "OR"
}
]
}
]