What is GHSA-rvrx-rrwh-r9p6?

GHSA-rvrx-rrwh-r9p6 is a security advisory published by GitHub Security Advisories with Medium severity. Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

Which CVE IDs does GHSA-rvrx-rrwh-r9p6 cover?

GHSA-rvrx-rrwh-r9p6 covers the following CVE IDs: CVE-2023-33958. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rvrx-rrwh-r9p6?

GHSA-rvrx-rrwh-r9p6 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rvrx-rrwh-r9p6?

GHSA-rvrx-rrwh-r9p6 affects 1 product, including: go/github.com/notaryproject/notation:\u003c 1.0.0-rc.6.

GHSA-rvrx-rrwh-r9p6MediumCVSS 6.5

Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

Vendor

GitHub Security Advisories

Published

June 6, 2023

Last Modified

November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-33958 →

📋 Description

Impact

An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running notation verify.

Patches

The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above.

Workarounds

User should use secure and trusted container registries

Credits

The notation project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.

🎯 Affected products1

go/github.com/notaryproject/notation:< 1.0.0-rc.6