CVE-2023-25656 notation-go has excessive memory allocation on verification
Attackers can cause excessive memory allocation during signature verification, leading to application crashes and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25656?
CVE-2023-25656 is a high-severity denial of service vulnerability in notaryproject notation-go, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.
Weakness: CWE-770
Which versions are affected by CVE-2023-25656?
3 open source packages ship an affected version, including github.com/notaryproject/notation-go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/notaryproject/notation-go Go | All versions | 1.0.0-rc.3 |
github.com/notaryproject/notation-go Go | All versions | 1.0.0-rc.3 |
github.com/notaryproject/notation-go Go | All versions | 1.0.0-rc.3 |
Products include Notaryproject Notation-Go.
How do I fix CVE-2023-25656?
Upgrade github.com/notaryproject/notation-go to 1.0.0-rc.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-25656 being exploited?
There is no known exploitation of CVE-2023-25656 in the wild and no public exploit code.
Other vulnerabilities in notaryproject notation-go
- CVE-2023-33959 Verification bypass can cause users into verifying the wrong artifact
- CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
- CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project
- CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go
- CVE-2023-33957 Denial of service from high number of artifact signatures in notation
Sources
Also known as GHSA-87x9-7grx-m28v, GO-2023-1589.