x/vulndb: potential Go vuln in github.com/notaryproject/notation: GHSA-9m3v-v4r5-ppx7

[GoVulnBot]

In GitHub Security Advisory GHSA-9m3v-v4r5-ppx7, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/notaryproject/notation	1.0.0-rc.6	< 1.0.0-rc.6

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/notaryproject/notation
      versions:
        - fixed: 1.0.0-rc.6
      packages:
        - package: github.com/notaryproject/notation
summary: Notation vulnerable to denial of service from high number of artifact signatures
description: |-
    ### Impact
    An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.

    ### Patches
    The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.

    ### Workarounds
    User should use secure and trusted container registries.

    ### Credits
    The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.
cves:
    - CVE-2023-33957
ghsas:
    - GHSA-9m3v-v4r5-ppx7
references:
    - advisory: https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7
    - fix: https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24
    - web: https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6
    - advisory: https://github.com/advisories/GHSA-9m3v-v4r5-ppx7

[gopherbot]

Change https://go.dev/cl/501842 mentions this issue: data/excluded: batch add 15 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)