PT-2023-24599

CVE-2023-33959

Publicado

2023-06-06

Atualizado

2024-04-01

Descrição por

CVSS 3.1

8.8

Alta

MétricasAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions notation versions prior to v1.0.0-rc.6

Description An attacker who has compromised a registry can cause users to verify the wrong artifact. This issue allows an attacker to lead a user into verifying the wrong artifact if they control or compromise a registry.

Recommendations For versions prior to v1.0.0-rc.6, upgrade the notation-go library to v1.0.0-rc.6 or above. As a temporary workaround for users unable to upgrade, restrict container registries to a set of secure and trusted container registries.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Adam Korczynski

Adamkorcz

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-347: Improper Verification of Cryptographic Signature

Identificadores relacionados