CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
An attacker with registry access can cause denial of service by adding excessive signatures, triggering resource exhaustion during verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-33958?
CVE-2023-33958 is a medium-severity denial of service vulnerability in notaryproject notation, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Weakness: CWE-400
Which versions are affected by CVE-2023-33958?
3 open source packages ship an affected version, including github.com/notaryproject/notation. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
github.com/notaryproject/notation Go | All versions | 1.0.0-rc.6 |
Products include Notaryproject Notation-Go.
How do I fix CVE-2023-33958?
Upgrade github.com/notaryproject/notation to 1.0.0-rc.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-33958 being exploited?
There is no known exploitation of CVE-2023-33958 in the wild and no public exploit code.
Other vulnerabilities in notaryproject notation
- CVE-2023-33959 Verification bypass can cause users into verifying the wrong artifact
- CVE-2023-25656 notation-go has excessive memory allocation on verification
- CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project
- CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go
- CVE-2023-33957 Denial of service from high number of artifact signatures in notation
Sources
Also known as GHSA-rvrx-rrwh-r9p6, GO-2023-1831.