notation-go has excessive memory allocation on verification
High severity
GitHub Reviewed
Published
Feb 20, 2023
in
notaryproject/notation-go
•
Updated Jul 12, 2023
Package
Affected versions
< 1.0.0-rc.3
Patched versions
1.0.0-rc.3
Description
Published by the National Vulnerability Database
Feb 20, 2023
Published to the GitHub Advisory Database
Feb 22, 2023
Reviewed
Feb 22, 2023
Last updated
Jul 12, 2023
Impact
notation-gousers will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.Patches
The problem has been patched in the release v1.0.0-rc.3. Users should upgrade their
notation-gopackages tov1.0.0-rc.3or above.Workarounds
Users can review their own trust policy file and check if the identity string contains
=#. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure theauthenticityvalidation is set toenforceCredits
The
notation-goproject would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.References
References