CVE-2024-56138 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-56138 Interim 1 13 2026-03-05T01:45:40Z current 2025-01-18T00:14:23Z 2026-03-05T01:45:40Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-56138 notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2025-January/020248.html E-Mail link for SUSE-SU-2025:0297-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3ISCFQBRATG2LAA3K5XNETXSCP77AAKA/ E-Mail link for openSUSE-SU-2025:14653-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed govulncheck-vulndb-0.0.20250115T172141-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 libxml2-2-2.11.6-slfo.1.1_6.1 libxml2-tools-2.11.6-slfo.1.1_6.1 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-qcow libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-qcow libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-qcow libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-qcow libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-Azure libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-Azure libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-Azure libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-Azure libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-EC2 libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-EC2 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-GCE libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-GCE libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-EC2 libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-EC2 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-GCE libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250115T172141-1.1 as a component of openSUSE Tumbleweed notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-56138 Container suse/sl-micro/6.0/baremetal-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/base-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/kvm-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/rt-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/toolbox:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-VMware:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-VMware:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-qcow:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-qcow:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-VMware:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-VMware:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-qcow:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-qcow:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-Azure:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-Azure:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-Azure:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-Azure:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-EC2:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-EC2:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-GCE:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-GCE:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-EC2:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-EC2:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-GCE:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-GCE:libxml2-tools-2.11.6-slfo.1.1_6.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250115T172141-1.1 moderate