VDB
CVE-2024-56138
CVE-2024-56138
PUBLISHED
CVSS 4 MEDIUM
notation-go's timestamp signature generation lacks certificate revocation check
EPSS 0.01% · 0.7th percentile
Risk Scores
CVSS 3.1
4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.01%
0.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | notaryproject/notation-go | 1.2.0-beta.1, 1.2.0-beta.1 |
| notaryproject | notation-go | < 1.3.0-rc.2, * |
Exploit Intelligence
- CIRCL seen: CVE-2024-56138 (circl-sighting)
- CIRCL seen: CVE-2024-56138 (circl-sighting)
- CIRCL published-proof-of-concept: CVE-2024-56138 (circl-sighting)
- CIRCL seen: CVE-2024-56138 (circl-sighting)
- https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v (circl)
- https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102 (circl)
Timeline
- Jan 21, 1970 Security Advisory
- Jan 13, 2025 CVE Published
- Jan 13, 2025 PoC Published
- Jan 13, 2025 PoC Published
- Jan 13, 2025 PoC Published
- Jan 13, 2025 PoC Published
- Jan 14, 2025 CVE Updated
- Jan 14, 2025 EPSS Score
- Jan 30, 2025 EPSS Score
- Feb 14, 2025 EPSS Score
- Mar 2, 2025 EPSS Score
- Mar 17, 2025 EPSS Score
References
- https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v url
- https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-56138 advisory
- https://github.com/notaryproject/notation-go/commit/e99be1954a15673020150c5f8800b8174cd7428d url
- https://github.com/notaryproject/notation-go package
- https://pkg.go.dev/vuln/GO-2025-3381 url