Skip to content
Fencer Vulns
medium 4.0

CVE-2024-56138 json

Timestamp signature generation lacks certificate revocation check in notion-go

published 2025-01-13 21 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-0008 , GHSA-45v3-38pc-874v , GO-2025-3381

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • go github.com/notaryproject/notation-go 1.3.0-rc.2
  • notaryproject notation-go 1.3.0-rc.2
  • golang-github-notaryproject-notation-go Debian 14 1.3.2-1

debian advisories DEBIAN-CVE-2024-56138

  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250128T150132-150000.1.29.1

suse advisories SUSE-SU-2025:0297-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250115T172141-1.1

opensuse advisories openSUSE-SU-2025:14653-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go github.com/notaryproject/notation-go
>=1.2.0-beta.1, <1.3.0-rc.2
1.3.0-rc.2

Affected products

  • notaryproject notation-go

Classification

Weakness
  • CWE-299 Improper Check for Certificate Revocation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.