{"id":"CVE-2024-56138","aliases":["GHSA-45v3-38pc-874v","GO-2025-3381"],"title":"notation-go's timestamp signature generation lacks certificate revocation check","summary":"notation-go's timestamp signature generation lacks certificate revocation check","severity":"medium","cvss":4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"notaryproject","product":"github.com/notaryproject/notation-go","ecosystem":"go","affected":["github.com/notaryproject/notation-go >= 1.2.0-beta.1, < 1.3.0-rc.2"],"patched":["github.com/notaryproject/notation-go 1.3.0-rc.2"],"published":"2025-01-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:21.902976341Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-45v3-38pc-874v","references":[{"url":"https://github.com/notaryproject/notation-go/security/advisories/GHSA-45v3-38pc-874v"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56138"},{"url":"https://github.com/notaryproject/notation-go/commit/e7005a6d13e5ba472d4e166fbb085152f909e102"},{"url":"https://github.com/notaryproject/notation-go/commit/e99be1954a15673020150c5f8800b8174cd7428d"},{"url":"https://github.com/notaryproject/notation-go"},{"url":"https://pkg.go.dev/vuln/GO-2025-3381"}],"tags":["osv","go"],"epss":0.00132,"epssPercentile":0.03168,"ingestedAt":"2026-09-12T03:13:01.751Z","slug":"CVE-2024-56138","body":"## Overview\n\nThis issue was identified during Quarkslab's audit of the timestamp feature.\n\n### Summary\nDuring the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified.\n\n### Details\nDuring timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`.\n\n### Impact\nThis could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations.\n\n\n## Affected packages\n\n- `github.com/notaryproject/notation-go >= 1.2.0-beta.1, < 1.3.0-rc.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/notaryproject/notation-go 1.3.0-rc.2`","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":22,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}