CVE-2023-33957

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jun 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-339586.5notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nuCVE-2023-339598.8notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to CVE-2023-33966.5A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0. It has been declared as critical. Affected by this vulnerability isCVE-2023-339607.5OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server CVE-2023-339615.4Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can iCVE-2023-339626.1JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowiCVE-2023-339639.8DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataCVE-2023-339647.5mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miCVE-2023-339658.8Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may foolCVE-2023-339669.8Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `noCVE-2023-339679.8EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PosCVE-2023-339685.4Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missin
CVE-2023-33957: Medium severity, CVSS 5.7 | Vulnix