PT-2023-6953 · Docker+4 · Docker Distribution+4

Anten Skrabec · Published 2023-05-09 · Updated 2025-01-07 · CVE-2023-2253

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions distribution versions prior to 2.8.2-beta.1

Description A flaw was found in the /v2/ catalog endpoint, which accepts a parameter to control the maximum number of records returned (query string: n). This vulnerability allows a malicious user to submit an unreasonably large value for n, causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory. The issue is related to unrestricted resource allocation and can be exploited by a remote attacker to cause a denial of service.

Recommendations Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code from the main branch, update at least to the commit after the specified commit. Restrict access to the affected /v2/ catalog API endpoint to minimize the risk of exploitation. Keep this API endpoint behind heightened privilege and avoid leaving it exposed to the internet.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-475

Related Identifiers

AZL-27020

AZL-27027

BDU:2023-07972

CVE-2023-2253

DLA-3473-1

DSA-5414-1

GHSA-HQXW-F8MX-CPMW

GO-2023-1772

MGASA-2023-0207

OPENSUSE-SU-2024:12926-1

SUSE-SU-2023:2153-1

SUSE-SU-2023:2154-1

SUSE-SU-2023:2298-1

SUSE-SU-2023_2153-1

SUSE-SU-2023_2154-1

SUSE-SU-2023_2298-1

USN-6336-1

Affected Products

Astra Linux

Docker Distribution

Linuxmint

Suse

Ubuntu

References · 45

• https://osv.dev/vulnerability/SUSE-SU-2023:2298-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5414 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-2253 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0207.html · Security Note
• https://osv.dev/vulnerability/GO-2023-1772 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2253 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2253 · Security Note
• https://osv.dev/vulnerability/DSA-5414-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27027 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3473-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-2253 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12926-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hqxw-f8mx-cpmw · Vendor Advisory