Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security audit of the Notary Project

blog.quarkslab.com | research | #supply-chain | #audit | #ostif | #cncf | #notary | #cve-2024-56138

Summary

Quarkslab audited the CNCF Notary Project for OSTIF, focusing on timestamping and CRL revocation added in v1.2.0/v1.3.0; findings include two CVEs and informational issues, all since addressed.
Published
Collected

original ↗

Related coverage

  1. Audit of Cloud Native Buildpacks (blog.quarkslab.com)
  2. Cortex Security Audit (blog.quarkslab.com)
  3. Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation (blog.quarkslab.com)
  4. Scala Security Audit (blog.quarkslab.com)
  5. Paramiko Security Audit (blog.quarkslab.com)
  6. EVerest security audit (blog.quarkslab.com)

back