https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:35:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-210295 EUVD-2026-210295 https://cve.radiocsirt.org/vuln/euvd-2026-210295 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56138 <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab&#39;s audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab&#39;s audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56138 https://cve.radiocsirt.org/vuln/ghsa-45v3-38pc-874v <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>This issue was identified during Quarkslab&#39;s audit of the timestamp feature.</p> <p>### Summary During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified.</p> <p>### Details During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`.</p> <p>### Impact This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations.</p> <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>This issue was identified during Quarkslab&#39;s audit of the timestamp feature.</p> <p>### Summary During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified.</p> <p>### Details During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`.</p> <p>### Impact This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations.</p> https://cve.radiocsirt.org/vuln/ghsa-45v3-38pc-874v https://cve.radiocsirt.org/vuln/opensuse-su-2025:14653-1 <p>govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14653-1 https://cve.radiocsirt.org/vuln/suse-su-2025:0297-1 <p>Security update for govulncheck-vulndb</p> <p>Security update for govulncheck-vulndb</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0297-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56138 <p><strong>Affected:</strong> Ubuntu:25.10: golang-github-notaryproject-notation, Ubuntu:25.10: golang-github-notaryproject-notation-go, Ubuntu:26.04:LTS: golang-github-notaryproject-notation-go, Ubuntu:Pro:26.04:LTS: golang-github-notaryproject-notation</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab&#39;s audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p><strong>Affected:</strong> Ubuntu:25.10: golang-github-notaryproject-notation, Ubuntu:25.10: golang-github-notaryproject-notation-go, Ubuntu:26.04:LTS: golang-github-notaryproject-notation-go, Ubuntu:Pro:26.04:LTS: golang-github-notaryproject-notation</p> <p>notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab&#39;s audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56138