CVE-2023-2253
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
Products: redhat openshift_api_for_data_protection, redhat openshift_container_platform, redhat openshift_developer_tools_and_services
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/distribution/distribution | 2.8.2-beta.1+incompatible |
| Go | github.com/docker/distribution | 2.8.2-beta.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | aactl | 0.4.12-r7 |
| Chainguard | argocd-image-updater | 0.17.0-r1 |
| Chainguard | argocd-image-updater-fips | 0.17.0-r2 |
| Chainguard | bom | 0.6.0-r0 |
| Chainguard | kpt | 1.0.0_beta31-r5 |
| Chainguard | kubernetes-dashboard | 2.7.0-r2 |
| Debian 10 | docker-registry | 2.6.2~ds1-2+deb10u1 |
| Debian 11 | docker-registry | 2.7.1+ds2-7+deb11u1 |
| Debian 12 | docker-registry | 2.8.2+ds1-1 |
| Debian 13 | docker-registry | 2.8.2+ds1-1 |
| Debian 14 | docker-registry | 2.8.2+ds1-1 |
| SUSE Linux Enterprise Module for Containers 12 | docker-distribution | 2.6.2-13.9.1 |
| SUSE Linux Enterprise Module for Containers 15 SP4 | distribution | 2.8.2-150400.9.21.1 |
| SUSE Linux Enterprise Module for Containers 15 SP4 | distribution | 2.8.1-150400.9.18.1 |
| Ubuntu 20.04 LTS | docker-registry | 2.7.1+ds2-7ubuntu0.3 |
| Ubuntu Pro 16.04 LTS | docker-registry | 2.3.0~ds1-1ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | docker-registry | 2.6.2~ds1-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | docker-registry | 2.8.0+ds1-4ubuntu0.1~esm2 |
| Wolfi | aactl | 0.4.12-r7 |
| Wolfi | argocd-image-updater | 0.17.0-r1 |
| Wolfi | bom | 0.6.0-r0 |
| Wolfi | kpt | 1.0.0_beta31-r5 |
| Wolfi | kubernetes-dashboard | 2.7.0-r2 |
| openSUSE Leap 15.4 | distribution | 2.8.1-150400.9.18.1 |
| openSUSE Leap 15.4 | distribution | 2.8.2-150400.9.21.1 |
| openSUSE Tumbleweed | distribution-registry | 2.8.2-1.1 |