Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature. An attacker can bypass signature validation by introducing a timestamp response signature that chains to a trusted root, allowing acceptance of forged timestamp responses. Remediation...