x/vulndb: potential Go vuln in github.com/notaryproject/notation: GHSA-rvrx-rrwh-r9p6

[GoVulnBot]

In GitHub Security Advisory GHSA-rvrx-rrwh-r9p6, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/notaryproject/notation	1.0.0-rc.6	< 1.0.0-rc.6

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/notaryproject/notation
      versions:
        - fixed: 1.0.0-rc.6
      packages:
        - package: github.com/notaryproject/notation
summary: Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack
description: |-
    ### Impact
    An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.

    ### Patches
    The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.

    ### Workarounds
    User should use secure and trusted container registries

    ### Credits
    The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.
cves:
    - CVE-2023-33958
ghsas:
    - GHSA-rvrx-rrwh-r9p6
references:
    - advisory: https://github.com/notaryproject/notation/security/advisories/GHSA-rvrx-rrwh-r9p6
    - web: https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6
    - advisory: https://github.com/advisories/GHSA-rvrx-rrwh-r9p6

[gopherbot]

Change https://go.dev/cl/501842 mentions this issue: data/excluded: batch add 15 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)