CVE-2023-33959

Name of the Vulnerable Software and Affected Versions notation versions prior to v1.0.0-rc.6

Description An attacker who has compromised a registry can cause users to verify the wrong artifact. This issue allows an attacker to lead a user into verifying the wrong artifact if they control or compromise a registry.

Recommendations For versions prior to v1.0.0-rc.6, upgrade the notation-go library to v1.0.0-rc.6 or above. As a temporary workaround for users unable to upgrade, restrict container registries to a set of secure and trusted container registries.