CVE-2023-33957 Denial of service from high number of artifact signatures in notation
An attacker with registry access can cause denial of service by adding excessive signatures, impacting users running the inspect command.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-33957?
CVE-2023-33957 is a low-severity denial of service vulnerability in notaryproject notation, published on 6 Jun 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Weakness: CWE-400
Which versions are affected by CVE-2023-33957?
3 open source packages ship an affected version, including github.com/notaryproject/notation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
Products include Notaryproject Notation-Go.
How do I fix CVE-2023-33957?
Upgrade github.com/notaryproject/notation to 1.0.0-rc.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-33957 being exploited?
There is no known exploitation of CVE-2023-33957 in the wild and no public exploit code.
Other vulnerabilities in notaryproject notation
- CVE-2023-33959 Verification bypass can cause users into verifying the wrong artifact
- CVE-2023-25656 notation-go has excessive memory allocation on verification
- CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
- CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project
- CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go
Sources
Also known as GHSA-9m3v-v4r5-ppx7, GO-2023-1829.