notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Metrics
Affected Vendors & Products
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1882 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries. |
 Github GHSA |
GHSA-rvrx-rrwh-r9p6 | Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T15:54:14.098Z
Reserved: 2023-05-24T13:46:35.952Z
Link: CVE-2023-33958
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-06-06T19:15:12.510
Modified: 2024-11-21T08:06:17.580
Link: CVE-2023-33958
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses