CVE-2023-33958
Medium
Description
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
SeverityMedium
CVSS5.4
Exploit probability—
ProductNotaryproject Notation-go
PublishedJun 6, 2023
First seenJun 6, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- notaryproject notation-go1.0.0 or later
- github.com/notaryproject/notation1.0.0-rc.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| notaryproject notation-go | v < 1.0.0, 1.0.0 | 1.0.0 |
| github.com/notaryproject/notationGo | v < 1.0.0-rc.6 | 1.0.0-rc.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.