{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-56138", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-12-16T17:30:30.068Z", "datePublished": "2025-01-13T21:37:59.729Z", "dateUpdated": "2025-01-14T00:26:00.838Z"}, "containers": {"cna": {"title": "Timestamp signature generation lacks certificate revocation check in notion-go", "problemTypes": [{"descriptions": [{"cweId": "CWE-299", "lang": "en", "description": "CWE-299: Improper Check for Certificate Revocation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v"}, {"name": "https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102", "tags": ["x_refsource_MISC"], "url": "https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102"}], "affected": [{"vendor": "notaryproject", "product": "notation-go", "versions": [{"version": "< 1.3.0-rc.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-13T21:37:59.729Z"}, "descriptions": [{"lang": "en", "value": "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-45v3-38pc-874v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-14T00:25:46.882500Z", "id": "CVE-2024-56138", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T00:26:00.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-56138", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-14T00:25:46.882500Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-14T00:25:57.077Z"}}], "cna": {"title": "Timestamp signature generation lacks certificate revocation check in notion-go", "source": {"advisory": "GHSA-45v3-38pc-874v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "notaryproject", "product": "notation-go", "versions": [{"status": "affected", "version": "< 1.3.0-rc.2"}]}], "references": [{"url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v", "name": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102", "name": "https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-299", "description": "CWE-299: Improper Check for Certificate Revocation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-13T21:37:59.729Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56138", "state": "PUBLISHED", "dateUpdated": "2025-01-14T00:26:00.838Z", "dateReserved": "2024-12-16T17:30:30.068Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-13T21:37:59.729Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "notion-go es una colecci\u00f3n de Librer\u00edas para respaldar la firma y verificaci\u00f3n de artefactos OCI. Basado en las especificaciones del Proyecto Notary. Este problema se identific\u00f3 durante la auditor\u00eda de Quarkslab de la caracter\u00edstica timestamp. Durante la generaci\u00f3n de la firma timestampp, no se verific\u00f3 el estado de revocaci\u00f3n de los certificados utilizados para generar la firma timestampmp. Durante la generaci\u00f3n de la firma timestampamp, notation-go no verific\u00f3 el estado de revocaci\u00f3n de la cadena de certificados utilizada por la TSA. Este descuido crea una vulnerabilidad que podr\u00eda explotarse a trav\u00e9s de un ataque Man-in-The-Middle. Un atacante podr\u00eda potencialmente usar un certificado de hoja comprometido, intermedio o revocado para generar una contrafirma maliciosa, que luego ser\u00eda aceptada y almacenada por `notation`. Esto podr\u00eda conducir a escenarios de denegaci\u00f3n de servicio, particularmente en entornos CI/CD durante los procesos de verificaci\u00f3n de firma, ya que la firma timestamptamp fallar\u00eda debido a la presencia de un certificado revocado que podr\u00eda interrumpir las operaciones. Este problema se ha solucionado en la versi\u00f3n 1.3.0-rc.2 y se recomienda a todos los usuarios que actualicen la versi\u00f3n. No se conocen Workarounds para esta vulnerabilidad."}], "id": "CVE-2024-56138", "lastModified": "2025-01-13T22:15:14.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-01-13T22:15:14.313", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102"}, {"source": "security-advisories@github.com", "url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-299"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}