CVE-2023-46737— Cosign 资源管理错误漏洞
一分钟漏洞结论
影响对象
sigstore cosign
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
cosign是美国的一个 OCI 注册表中的容器签名、验证和存储。 Cosign 2.2.0及之前版本存在资源管理错误漏洞，该漏洞源于允许攻击者控制注册表并导致拒绝服务（DOS）。
可能的 ATT&CK 技术 1 AI
T1499 · Endpoint Denial of Service
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-46737 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Possible endless data attack from attacker-controlled registry in cosign
来源: CVE Program / CVE List V5
Vulnerability Description
Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is that Cosign loops through all attestations fetched from the remote registry in pkg/cosign.FetchAttestations. The attacker needs to compromise the registry or make a request to a registry they control. When doing so, the attacker must return a high number of attestations in the response to Cosign. The result will be that the attacker can cause Cosign to go into a long or infinite loop that will prevent other users from verifying their data. In Kyvernos case, an attacker whose privileges are limited to making requests to the cluster can make a request with an image reference to their own registry, trigger the infinite loop and deny other users from completing their admission requests. Alternatively, the attacker can obtain control of the registry used by an organization and return a high number of attestations instead the expected number of attestations. The issue can be mitigated rather simply by setting a limit to the limit of attestations that Cosign will loop through. The limit does not need to be high to be within the vast majority of use cases and still prevent the endless data attack. This issue has been patched in version 2.2.1 and users are advised to upgrade.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
来源: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
来源: CVE Program / CVE List V5
Vulnerability Title
Cosign 资源管理错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
cosign是美国的一个 OCI 注册表中的容器签名、验证和存储。 Cosign 2.2.0及之前版本存在资源管理错误漏洞，该漏洞源于允许攻击者控制注册表并导致拒绝服务（DOS）。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2023-46737 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-46737 的情报信息
请登录查看更多情报信息。
CVE-2023-46737 补丁与修复 (1)
CVE-2023-46737 厂商安全公告 (1)
-
https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9 x_refsource_CONFIRM
IV. Related Vulnerabilities
V. Comments for CVE-2023-46737
暂无评论