GHSA-57wx-m636-g3g8 · 深刻度： medium · エコシステム： go — Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry
The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such as `permissive` instead of `strict`) to potentially use artifacts with signatures that are no longer valid, making them susceptible to any exploits those artifacts may contain. In Notary Project, an artifact publisher can control the validity period of artifact by specifying signature expiry during the signing process. Using shorter signature validity periods along with processes to periodically resign artifacts, allows artifact producers to ensure that their consumers will only receive up-to-date artifacts. Artifact consumers should correspondingly use a `strict` or equivalent trust policy that enforces signature expiry. Together these steps enable use of up-to-date artifacts and safeguard against rollback attack in the event of registry compromise. The Notary Project offers various signature validation options such as `permissive`, `audit` and `skip` to support various scenarios. These scenarios includes 1) situations demanding urgent workload deployment, necessitating the bypassing of expired or revoked signatures; 2) auditing of artifacts lacking signatures without interrupting workload; and 3) skipping of verification for specific images that might have undergone validation through alternative mechanisms. Additionally, the Notary Project supports revocation to ensure the signature freshness. Artifact publishers can sign with short-lived certificates and revoke older certificates when necessary. This revocation serves as a signal to inform artifact consumers that the corresponding unexpired artifact is no longer approved by the publisher. This enables the artifact publisher to control the validity of the signature independently of their ability to manage artifacts in a compromised registry.
総合評価: CVE-2024-23332 は低リスク（23.3/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.29%、20 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.04% | 0.29% | +0.25% |
| 2 | 2025-11-21 | 0.61% | 0.04% | -0.57% |
| 3 | 2025-11-18 | — | 0.61% | — |
EPSS の全履歴 （全 9 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 4.0 | 3.1 | MEDIUM |
|
1.0 | 2.7 | [email protected] |
| 6.8 | 3.1 | MEDIUM |
|
0.9 | 5.9 | [email protected] |
GHSA-57wx-m636-g3g8 · 深刻度： medium · エコシステム： go — Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| notaryproject | notation-go | — | cpe:2.3:a:notaryproject:notation-go:*:*:*:*:*:*:*:* |