https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:18:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-210294 EUVD-2026-210294 https://cve.radiocsirt.org/vuln/euvd-2026-210294 https://cve.radiocsirt.org/vuln/fkie_cve-2024-51491 <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade.…</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade.…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-51491 https://cve.radiocsirt.org/vuln/ghsa-qjh3-4j3h-vmwp <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>### Summary The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination.</p> <p>### Details</p> <p>In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on `rename` syscall from the libc and as per the [documentation](https://man7.org/linux/man-pages/man2/rename.2.html), moving a file to a different mountpoint raises an `EXDEV` error, interpreted as `Cross device link not permitted error`. Some Linux distribution, like `RedHat` use a dedicated filesystem (`tmpfs`), mounted on a specific mountpoint (usually `/tmp`) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash `notation`.</p> <p>### PoC 1. Ensure that the temporary file storage area (e.g., /tmp) is mounted on a different mount point than the user&#39;s &#39;notation&#39; cache directory. 2. Either disable the Online Certificate Statu…</p> <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>### Summary The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination.</p> <p>### Details</p> <p>In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on `rename` syscall from the libc and as per the [documentation](https://man7.org/linux/man-pages/man2/rename.2.html), moving a file to a different mountpoint raises an `EXDEV` error, interpreted as `Cross device link not permitted error`. Some Linux distribution, like `RedHat` use a dedicated filesystem (`tmpfs`), mounted on a specific mountpoint (usually `/tmp`) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash `notation`.</p> <p>### PoC 1. Ensure that the temporary file storage area (e.g., /tmp) is mounted on a different mount point than the user&#39;s &#39;notation&#39; cache directory. 2. Either disable the Online Certificate Statu…</p> https://cve.radiocsirt.org/vuln/ghsa-qjh3-4j3h-vmwp https://cve.radiocsirt.org/vuln/opensuse-su-2025:14653-1 <p>govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14653-1 https://cve.radiocsirt.org/vuln/suse-su-2025:0297-1 <p>Security update for govulncheck-vulndb</p> <p>Security update for govulncheck-vulndb</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0297-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-51491 <p><strong>Affected:</strong> Ubuntu:25.10: golang-github-notaryproject-notation, Ubuntu:25.10: golang-github-notaryproject-notation-go, Ubuntu:26.04:LTS: golang-github-notaryproject-notation-go, Ubuntu:Pro:26.04:LTS: golang-github-notaryproject-notation</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade.…</p> <p><strong>Affected:</strong> Ubuntu:25.10: golang-github-notaryproject-notation, Ubuntu:25.10: golang-github-notaryproject-notation-go, Ubuntu:26.04:LTS: golang-github-notaryproject-notation-go, Ubuntu:Pro:26.04:LTS: golang-github-notaryproject-notation</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab&#39;s security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade.…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-51491