id: GO-2023-1832
modules:
    - module: github.com/notaryproject/notation-go
      versions:
        - fixed: 1.0.0-rc.6
      vulnerable_at: 1.0.0-rc.5
      packages:
        - package: github.com/notaryproject/notation-go
          symbols:
            - Sign
            - Verify
summary: Verification bypass in github.com/notaryproject/notation-go
description: |-
    An attacker who controls or compromises a registry can lead a user to verify the
    wrong artifact.
cves:
    - CVE-2023-33959
ghsas:
    - GHSA-xhg5-42rf-296r
credits:
    - Adam Korczynski (@AdamKorcz)
    - Shiwei Zhang (@shizhMSFT)
    - Pritesh Bandi (@priteshbandi)
references:
    - advisory: https://github.com/notaryproject/notation-go/security/advisories/GHSA-xhg5-42rf-296r
    - fix: https://github.com/notaryproject/notation-go/commit/39c8ed050a65cca3f3f308534acb612096735a64
    - fix: https://github.com/notaryproject/notation-go/commit/eba60f5aed9c9e05dee55324423c95fe34700b4c
    - web: https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6