CVE-2023-33959: github.com/notaryproject/notation-go fixed in v1.0.0-rc.6

CVE-2023-33959 PUBLISHED CVSS 8.4 HIGH

Verification bypass can cause users into verifying the wrong artifact

Reported by github_m · Published June 6, 2023

github.com/notaryproject/notation-go is fixed in v1.0.0-rc.6 (Go Modules)

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/notaryproject/notation-go	Go Modules	v1.0.0-rc.6

Risk scores

CVSS 3.1

8.4

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
notaryproject	notation-go	< 1.0.0-rc.6
wolfi	kyverno	0
chainguard	kyverno	0
chainguard	zot	0
notaryproject	notation-go	0
wolfi	zot	0
github.com	notaryproject/notation-go	0

Timeline

Jun 6, 2023 CVE Published
Jun 7, 2023 EPSS Score (30 in total, the first dated here)
Jun 27, 2023 CVE Updated
Feb 14, 2026 Security Advisory
Aug 9, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-33959
vulnetix vdb fixes CVE-2023-33959

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-33959/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →