CVE-2023-33958

Description

Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack in github.com/notaryproject/notation

Affected packages (2)

• Go/github.com/notaryproject/notationfrom 0, < 1.0.0-rc.6
• Go/github.com/notaryproject/notationfrom 0, < 1.0.0-rc.6

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-33958
• PATCHhttps://github.com/notaryproject/notation
• WEBhttps://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6
• WEBhttps://github.com/notaryproject/notation/security/advisories/GHSA-rvrx-rrwh-r9p6