VDB
GO-2023-2188
GO-2023-2188
PUBLISHED
slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | slsa-framework/slsa-verifier | 0, 0, 0 |
| github.com | slsa-framework/slsa-verifier/v2 | 0, 0, 0 |
Timeline
- Aug 21, 2024 CVE Published
- Feb 4, 2026 CVE Updated
References
- https://github.com/slsa-framework/slsa-verifier/security/advisories/GHSA-r2xv-vpr2-42m9 advisory
- https://github.com/npm/attestation/tree/main/specs/publish/v0.1 url
- https://openssf.slack.com/archives/C03PDLFET5W/p1695330038983179 url
- https://github.com/slsa-framework/slsa-verifier/pull/705 fix
- https://github.com/slsa-framework/slsa-verifier/commit/f6ae402f458b347d2c414f1d053fc1f8257888d0 fix