PT-2023-20216 · Unknown · Notation-Go

Adam Korczynski + 3 · Published 2023-02-20 · Updated 2024-02-29 · CVE-2023-25656

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions notation-go versions prior to 1.0.0-rc.3

Description The issue causes excessive memory consumption when verifying signatures, leading to application crashes and impacting availability. Users can review their trust policy file for the identity string containing =# and ensure only trusted certificates are in their trust stores with authenticity validation set to enforce.

Recommendations For versions prior to 1.0.0-rc.3, upgrade to version 1.0.0-rc.3 or above. As a temporary workaround, review your trust policy file and check if the identity string contains =#. Meanwhile, only put trusted certificates in your trust stores referenced by your trust policy files, and make sure the authenticity validation is set to enforce.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-25656

GHSA-87X9-7GRX-M28V

GO-2023-1589

Affected Products

Notation-Go

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25656.json · Exploit
• https://github.com/notaryproject/notation-go/security/advisories/GHSA-87x9-7grx-m28v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25656 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1589 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87x9-7grx-m28v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25656 · Security Note
• https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3 · Note
• https://github.com/notaryproject/notation-go · Note
• https://github.com/notaryproject/notation-go/pull/275 · Note
• https://t.me/cibsecurity/58523 · Telegram Post
• https://t.me/cvenotify/44680 · Telegram Post
• https://t.me/cvenotify/72715 · Telegram Post