PT-2023-6953 · Docker+4 · Docker Distribution+4
Anten Skrabec
·
Publicado
2023-05-09
·
Atualizado
2025-01-07
·
CVE-2023-2253
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
distribution versions prior to 2.8.2-beta.1
Description
A flaw was found in the
/v2/ catalog endpoint, which accepts a parameter to control the maximum number of records returned (query string: n). This vulnerability allows a malicious user to submit an unreasonably large value for n, causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory. The issue is related to unrestricted resource allocation and can be exploited by a remote attacker to cause a denial of service.Recommendations
Upgrade to at least 2.8.2-beta.1 if you are running
v2.8.x release.
If you use the code from the main branch, update at least to the commit after the specified commit.
Restrict access to the affected /v2/ catalog API endpoint to minimize the risk of exploitation.
Keep this API endpoint behind heightened privilege and avoid leaving it exposed to the internet.Correção
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Astra Linux
Docker Distribution
Linuxmint
Suse
Ubuntu