CVE-2024-56138

notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-299

• https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102
• https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v

Published

Jan 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56132Improper Input Validation vulnerability of Authenticated Use…6.8
• CVE-2024-56133Improper Input Validation vulnerability of Authenticated Use…6.8
• CVE-2024-56134Improper Input Validation vulnerability of Authenticated Use…6.8
• CVE-2024-56135Improper Input Validation vulnerability of Authenticated Use…6.8
• CVE-2024-56136Zulip server provides an open-source team chat that helps te…5.3
• CVE-2024-56137MaxKB, which stands for Max Knowledge Base, is an open sourc…7.2
• CVE-2024-56139pdftools is a high level tools to convert PDF files to ePUB …6.9
• CVE-2024-5614The Piotnet Addons For Elementor plugin for WordPress is vul…5.3
• CVE-2024-56140Astro is a web framework for content-driven websites. In aff…6.5
• CVE-2024-56141Minosoft is an open-source, multi-version Minecraft Java Edi…5
• CVE-2024-56142pghoard is a PostgreSQL backup daemon and restore tooling th…6.5
• CVE-2024-56143Strapi is an open-source headless content management system.…8.2