CVE-2023-33959
📋 TL;DR
This vulnerability in the notation CLI tool allows attackers who have compromised a container registry to trick users into verifying the wrong artifact. This affects anyone using notation versions before v1.0.0-rc.6 to sign or verify OCI artifacts and container images.
💻 Affected Systems
- notation CLI tool
- notation-go library
📦 What is this software?
Notation Go by Notaryproject
Notation Go by Notaryproject
Notation Go by Notaryproject
Notation Go by Notaryproject
Notation Go by Notaryproject
Notation Go by Notaryproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers could substitute malicious container images for legitimate ones, leading to supply chain attacks, data breaches, or system compromise.
Likely Case
Compromised registries could serve malicious artifacts that appear legitimate, potentially leading to unauthorized code execution in container environments.
If Mitigated
With proper controls, the impact is limited to specific registries that have been compromised, reducing the attack surface.
🎯 Exploit Status
Requires registry compromise first, then exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.0-rc.6 and above
Vendor Advisory: https://github.com/notaryproject/notation-go/security/advisories/GHSA-xhg5-42rf-296r
Restart Required: No
Instructions:
1. Update notation-go library to v1.0.0-rc.6 or later. 2. Rebuild any applications using the library. 3. Update notation CLI tool if using standalone version.
🔧 Temporary Workarounds
Restrict to trusted registries
allLimit container registry access to a predefined list of secure and trusted registries only.
# Configure registry allowlist in your container runtime or notation configuration
🧯 If You Can't Patch
- Implement strict registry allowlisting to only trusted sources
- Monitor registry access patterns for anomalies and unauthorized changes
🔍 How to Verify
Check if Vulnerable:
Check notation version: notation versionCheck Version:
notation versionVerify Fix Applied:
Verify notation version is v1.0.0-rc.6 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected registry changes
- Failed verification attempts
- Registry access from unauthorized sources
Network Indicators:
- Unusual registry traffic patterns
- Connections to untrusted registries
SIEM Query:
Search for notation verification failures or registry access anomalies