CVE-2023-2253

Description

A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.

How to fix CVE-2023-2253

To remediate CVE-2023-2253, upgrade the affected package to a fixed version below.

• —upgrade to 2.7.1+ds2-7+deb11u1 or later
• —upgrade to 2.6.2~ds1-2+deb10u1 or later
• —upgrade to 2.7.1+ds2-7+deb11u1 or later
• —upgrade to 2.8.2-beta.1+incompatible or later
• —upgrade to 2.8.2-beta.1 or later

Is CVE-2023-2253 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 2.7.1+ds2-7+deb11u1
• from 0, < 2.6.2~ds1-2+deb10u1
• from 0, < 2.7.1+ds2-7+deb11u1
• from 0, < 2.8.2-beta.1+incompatible
• from 0, < 2.8.2-beta.1

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-hqxw-f8mx-cpmw
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-2253
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-2253
• PATCHgithub.com/distribution/distribution
• WEB