github - ghsa-87x9-7grx-m28v

ghsa-87x9-7grx-m28v

Vulnerability from github

Published

2023-02-22 00:03

Modified

2023-02-22 00:03

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

notation-go has excessive memory allocation on verification

Details

Impact

notation-go users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.

Patches

The problem has been patched in the release v1.0.0-rc.3. Users should upgrade their notation-go packages to v1.0.0-rc.3 or above.

Workarounds

Users can review their own trust policy file and check if the identity string contains =#. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the authenticity validation is set to enforce

Credits

The notation-go project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.

References

Resource exhaustion attacks

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/notaryproject/notation-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-rc.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-25656"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-22T00:03:49Z",
    "nvd_published_at": "2023-02-20T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n`notation-go` users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.\n\n### Patches\n\nThe problem has been patched in the release [v1.0.0-rc.3](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3). Users should upgrade their `notation-go` packages to `v1.0.0-rc.3` or above.\n\n### Workarounds\n\nUsers can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`\n\n### Credits\n\nThe `notation-go` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.\n\n### References\n\n- [Resource exhaustion attacks](https://en.wikipedia.org/wiki/Resource_exhaustion_attack)\n",
  "id": "GHSA-87x9-7grx-m28v",
  "modified": "2023-02-22T00:03:49Z",
  "published": "2023-02-22T00:03:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25656"
    },
    {
      "type": "WEB",
      "url": "https://github.com/notaryproject/notation-go/pull/275"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/notaryproject/notation-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "notation-go has excessive memory allocation on verification"
}

CVE-2023-25656 (GCVE-0-2023-25656)

Vulnerability from cvelistv5

Published

2023-02-20 00:00

Modified

2024-11-27 16:45

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.

References

▼	URL	Tags
	https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3
	https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28v

Impacted products

	Vendor	Product	Version
	notaryproject	notation-go	Version: 1.0.0-rc.3 < 1.0.0-rc.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:25:19.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28v"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-25656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T18:45:46.036047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T16:45:09.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "notation-go",
          "vendor": "notaryproject",
          "versions": [
            {
              "lessThan": "1.0.0-rc.3",
              "status": "affected",
              "version": "1.0.0-rc.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-21T00:00:00",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3"
        },
        {
          "url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28v"
        }
      ],
      "source": {
        "advisory": "GHSA-87x9-7grx-m28v",
        "defect": [
          "GHSA-87x9-7grx-m28v"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "notation-go has excessive memory allocation on verification",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-25656",
    "datePublished": "2023-02-20T00:00:00",
    "dateReserved": "2023-02-09T00:00:00",
    "dateUpdated": "2024-11-27T16:45:09.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-87x9-7grx-m28v

Vulnerability from github

Impact

Patches

Workarounds

Credits

References

CVE-2023-25656 (GCVE-0-2023-25656)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature