GHSA-xhg5-42rf-296r

notation-go's verification bypass can cause users to verify the wrong artifact

Source: GitHub Advisory Database (reviewed) High CVE-2023-33959

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/notaryproject/notation-go	< 1.0.0-rc.6	1.0.0-rc.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker who controls or compromises a registry can lead a user to verify the wrong artifact. ### Patches The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6). Users should upgrade their notation-go library to [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6) or above. ### Workarounds User should use secure and trusted container registries. ### Credits The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi) for root cause analysis.

References

External links from the advisory. They lead to third-party sites.