CVE-2023-33959 Verification bypass can cause users into verifying the wrong artifact

What is CVE-2023-33959?

CVE-2023-33959 is a high-severity vulnerability in notaryproject notation-go, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.

Weakness: CWE-347

Which versions are affected by CVE-2023-33959?

3 open source packages ship an affected version, including github.com/notaryproject/notation-go. It affects 1 product.

Products include Notaryproject Notation-Go.

How do I fix CVE-2023-33959?

Upgrade github.com/notaryproject/notation-go to 1.0.0-rc.6 or later.

Is CVE-2023-33959 being exploited?

There is no known exploitation of CVE-2023-33959 in the wild and no public exploit code.

Other vulnerabilities in notaryproject notation-go

• CVE-2023-25656 notation-go has excessive memory allocation on verification High 7.5
• CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation Medium 5.4
• CVE-2024-23332 Client configured with permissive trust policies susceptible to rollback attack in Notary Project Medium 4.0
• CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go Low 3.3
• CVE-2023-33957 Denial of service from high number of artifact signatures in notation Low 2.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xhg5-42rf-296r, GO-2023-1832.