CGA-9h64-qxcj-h5wh

Summary

notation-go's verification bypass can cause users to verify the wrong artifact

Description

Impact

An attacker who controls or compromises a registry can lead a user to verify the wrong artifact.

Patches

The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above.

Workarounds

User should use secure and trusted container registries.

Credits

The notation project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi) for root cause analysis.