{"answers":{"affected":"3 open source packages ship an affected version, including github.com/notaryproject/notation. It affects 1 product.","exploited":"There is no known exploitation of CVE-2024-23332 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-23332 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-23332 is a medium-severity vulnerability in notaryproject specifications, published on 19 Jan 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-23332 and fix it if it is affected.\n\nWhat it is: CVE-2024-23332 is a medium-severity vulnerability in notaryproject specifications, published on 19 Jan 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2024-23332 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/notaryproject/notation (Go): affected all versions; no fix listed\n- github.com/notaryproject/notation (Go): affected all versions up to 1.0.0; no fix listed\n- github.com/notaryproject/notation (Go): affected all versions up to 1.0.0; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-23332/ (Markdown: https://insights.sbomify.com/CVE-2024-23332/index.md)","id":"CVE-2024-23332","markdown":"https://insights.sbomify.com/CVE-2024-23332/index.md","name":"CVE-2024-23332","record":{"aliases":["GHSA-57wx-m636-g3g8","GO-2024-2472"],"analysis":{"component_type":"library","fix_type":"configuration_change","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Notary Project","requires_auth":"high_privilege","summary":"Attackers can serve outdated, vulnerable container images to clients using permissive trust policies, bypassing signature expiry checks.","user_interaction":"required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"notation-go","vendor":"notaryproject"}],"cvss":{"score":4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-672","name":"Operation on a Resource after Expiration or Release"}],"description":"The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such as `permissive` instead of `strict`) to potentially use artifacts with signatures that are no longer valid, making them susceptible to any exploits those artifacts may contain. In Notary Project, an artifact publisher can control the validity period of artifact by specifying signature expiry during the signing process. Using shorter signature validity periods along with processes to periodically resign artifacts, allows artifact producers to ensure that their consumers will only receive up-to-date artifacts. Artifact consumers should correspondingly use a `strict` or equivalent trust policy that enforces signature expiry. Together these steps enable use of up-to-date artifacts and safeguard against rollback attack in the event of registry compromise. The Notary Project offers various signature validation options such as `permissive`, `audit` and `skip` to support various scenarios. These scenarios includes 1) situations demanding urgent workload deployment, necessitating the bypassing of expired or revoked signatures; 2) auditing of artifacts lacking signatures without interrupting workload; and 3) skipping of verification for specific images that might have undergone validation through alternative mechanisms. Additionally, the Notary Project supports revocation to ensure the signature freshness. Artifact publishers can sign with short-lived certificates and revoke older certificates when necessary. This revocation serves as a signal to inform artifact consumers that the corresponding unexpired artifact is no longer approved by the publisher. This enables the artifact publisher to control the validity of the signature independently of their ability to manage artifacts in a compromised registry.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Client configured with permissive trust policies susceptible to rollback attack in Notary Project","id":"CVE-2024-23332","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"supply_chain","year":"2024"},"n_packages":3,"n_references":2,"next":{"headline":"LAM vulnerable to Authenticated Remote Code Execution","id":"CVE-2024-23333"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/notaryproject/notation","purl":"pkg:golang/github.com/notaryproject/notation","source":"GO-2024-2472"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.0.0"],"package":"github.com/notaryproject/notation","purl":null,"source":"GHSA-57wx-m636-g3g8"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.0.0"],"package":"github.com/notaryproject/notation","purl":"pkg:golang/github.com/notaryproject/notation","source":"GHSA-57wx-m636-g3g8"}],"prev":{"headline":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","id":"CVE-2024-23331"},"products":["specifications"],"published":"2024-01-19","related":[{"cvss_score":8.4,"headline":"Verification bypass can cause users into verifying the wrong artifact","id":"CVE-2023-33959","kev_date_added":null,"published":"2023-06-06"},{"cvss_score":7.5,"headline":"notation-go has excessive memory allocation on verification","id":"CVE-2023-25656","kev_date_added":null,"published":"2023-02-20"},{"cvss_score":5.4,"headline":"Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation","id":"CVE-2023-33958","kev_date_added":null,"published":"2023-06-06"},{"cvss_score":3.3,"headline":"Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go","id":"CVE-2024-51491","kev_date_added":null,"published":"2025-01-13"},{"cvss_score":2.6,"headline":"Denial of service from high number of artifact signatures in notation","id":"CVE-2023-33957","kev_date_added":null,"published":"2023-06-06"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-05-30","vendors":["notaryproject"]},"summary":"Attackers can serve outdated, vulnerable container images to clients using permissive trust policies, bypassing signature expiry checks.","url":"https://insights.sbomify.com/CVE-2024-23332/"}