CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project

🗓️ 19 Jan 2024 22:19:37Reported by GitHub_MType

Client permissive trust policies vulnerable to Notary Project rollback attac

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-23332	20 Jan 202400:21	–	circl
CNNVD	Notary Project Specifications Security Vulnerabilities	19 Jan 202400:00	–	cnnvd
CVE	CVE-2024-23332	19 Jan 202422:19	–	cve
EUVD	EUVD-2024-0257	3 Oct 202520:07	–	euvd
Github Security Blog	Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry	19 Jan 202422:12	–	github
NVD	CVE-2024-23332	19 Jan 202423:15	–	nvd
OSV	CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project	19 Jan 202422:19	–	osv
OSV	GHSA-57WX-M636-G3G8 Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry	19 Jan 202422:12	–	osv
OSV	GO-2024-2472 Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry	28 Jun 202415:28	–	osv
Prion	Design/Logic Flaw	19 Jan 202423:15	–	prion

[
  {
    "vendor": "notaryproject",
    "product": "specifications",
    "versions": [
      {
        "version": "<= 1.0.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/notaryproject/specifications/security/advisories/GHSA-57wx-m636-g3g8
github	www.github.com/notaryproject/specifications/commit/cdabdd1042de2999c685fa5d422a785ded9c983a

19 Jan 2024 22:19Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.14

EPSS0.00288

CWE-672