notation-go up to 1.0.0-rc.2 Signature Verification resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in notation-go up to 1.0.0-rc.2. Affected by this issue is some unknown functionality of the component Signature Verification. The manipulation leads to resource consumption. This vulnerability is traded as CVE-2023-25656. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in notation-go up to 1.0.0-rc.2. This issue affects an unknown code of the component Signature Verification. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

notation-go is a collection of libraries for supporting Notation sign, verify, push, pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.

The weakness was shared 02/20/2023 as GHSA-87x9-7grx-m28v. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-25656 since 02/09/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.0.0-rc.3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-0663). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• notation-go

Version

• 1.0.0-rc.0
• 1.0.0-rc.1
• 1.0.0-rc.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion