CVE-2023-33958
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-400
Consumo de recursos no controlado (Agotamiento de recursos)
Fecha de publicación:
06/06/2023
Última modificación:
29/02/2024
Descripción
*** Pendiente de traducción *** notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:notaryproject:notation-go:*:*:*:*:*:*:*:* | 1.0.0 (excluyendo) | |
| cpe:2.3:a:notaryproject:notation-go:1.0.0:rc1:*:*:*:*:*:* | ||
| cpe:2.3:a:notaryproject:notation-go:1.0.0:rc2:*:*:*:*:*:* | ||
| cpe:2.3:a:notaryproject:notation-go:1.0.0:rc3:*:*:*:*:*:* | ||
| cpe:2.3:a:notaryproject:notation-go:1.0.0:rc4:*:*:*:*:*:* | ||
| cpe:2.3:a:notaryproject:notation-go:1.0.0:rc5:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página