VDB
RHSA-2023%3A5390
RHSA-2023%3A5390
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-apiserver-network-proxy-rhel8@sha256:ca0860d0e5102ada3d6b80f93b9d3d8407af9503efc1783f97a3b3abfbfd3d0f_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-apiserver-network-proxy-rhel8@sha256:ca0860d0e5102ada3d6b80f93b9d3d8407af9503efc1783f97a3b3abfbfd3d0f_arm64 |
| Red Hat | openshift4/ose-machine-config-operator@sha256:308cc282d5454cc514495d6fbed5c22e7a494e2a797b8b7edf8ce33af5c3c428_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-ovn-kubernetes@sha256:92e36c487bff9421903beb6c9294ab90a17c03c8cac2b745c29c46353b4ad4c3_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-ovn-kubernetes@sha256:4624d41a76c02b0da3b4ff22f0d6655c5f37df44a7d7ce1ec1b52b564295fb16_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-ovn-kubernetes@sha256:4624d41a76c02b0da3b4ff22f0d6655c5f37df44a7d7ce1ec1b52b564295fb16_amd64 |
| Red Hat | openshift4/ose-installer@sha256:256671e9350ae4168e35df1ae34f72b88f7a5a8cfc84e295ed8d6f042a94fe9d_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-installer@sha256:256671e9350ae4168e35df1ae34f72b88f7a5a8cfc84e295ed8d6f042a94fe9d_amd64 |
| Red Hat | openshift4/ose-installer@sha256:73da55da55f56ede347a11a9d1c540e3cbaa100bb010508d696ac7ee01f24e4b_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-installer@sha256:73da55da55f56ede347a11a9d1c540e3cbaa100bb010508d696ac7ee01f24e4b_arm64 |
| Red Hat | openshift4/ose-installer-artifacts@sha256:f69e95be4ec161eb6f495c09b78ada8c81c6b1dbf4eb0f4f346b7b99e2c49766_s390x as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-hypershift-rhel8@sha256:ba16a27877009816f49a51bdfabfffd99c6a6468941afbdd8ff59f0a49a9db35_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-hypershift-rhel8@sha256:ba16a27877009816f49a51bdfabfffd99c6a6468941afbdd8ff59f0a49a9db35_arm64 |
| Red Hat | openshift4/ose-installer-artifacts@sha256:97ded3d08e00bfe4e45419fa47dc502545f5ffaaf5e544a23681e920f618083f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-installer-artifacts@sha256:97ded3d08e00bfe4e45419fa47dc502545f5ffaaf5e544a23681e920f618083f_amd64 |
| Red Hat | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:9cab97735315251aa36f7c8189217a8b397f9fb8da70822dd0b99b34dfdf0bc5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:9cab97735315251aa36f7c8189217a8b397f9fb8da70822dd0b99b34dfdf0bc5_amd64 |
| Red Hat | openshift4/ose-apiserver-network-proxy-rhel8@sha256:5b26090a6ffad17ddbe25458dc2c0dd0e60235569537011721a406186c402f01_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:b4eea4d528e39cf46d21dd3d6304c0e78df82fc3c44904f5abab30302a9cb5d5_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:b4eea4d528e39cf46d21dd3d6304c0e78df82fc3c44904f5abab30302a9cb5d5_ppc64le |
| Red Hat | openshift4/ose-cluster-baremetal-operator-rhel8@sha256:e36eecb1d894adaef0f2583609790a6b9e4e17e47dc43ed37351dc38d60d7bb4_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-cluster-baremetal-operator-rhel8@sha256:e36eecb1d894adaef0f2583609790a6b9e4e17e47dc43ed37351dc38d60d7bb4_amd64 |
| Red Hat | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:cb8f32e23089128f9c948c25f6cbfb687037a22e193a122f79900d8b3f0fbfa0_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:cb8f32e23089128f9c948c25f6cbfb687037a22e193a122f79900d8b3f0fbfa0_arm64 |
| Red Hat | openshift4/ose-installer@sha256:0028f4a966bfa296779e6aa6431a47f8c34397e4de21c67384c0510417261e76_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-installer@sha256:0028f4a966bfa296779e6aa6431a47f8c34397e4de21c67384c0510417261e76_ppc64le |
| Red Hat | openshift4/ose-insights-rhel8-operator@sha256:b164df0434429bed1e44ade80bd39689b2871aad615bed515f36ddb3e46f8f5c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-ovn-kubernetes@sha256:edaa5fc7a54cabe8fce6823032dec74e785914cc2c6c3a4fed0c1bd4f3611a94_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-ovn-kubernetes@sha256:edaa5fc7a54cabe8fce6823032dec74e785914cc2c6c3a4fed0c1bd4f3611a94_s390x |
| Red Hat | openshift4/ose-insights-rhel8-operator@sha256:b3e8b64396a90e5513fe82a80a3b3ff303336cc50455ec793e0258f7bedee619_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-insights-rhel8-operator@sha256:b3e8b64396a90e5513fe82a80a3b3ff303336cc50455ec793e0258f7bedee619_ppc64le |
| Red Hat | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:45c48778a27bcd866b6ce189b9d5f3ca508d933ec68f01580913960e151a2a40_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-openstack-rhel8@sha256:45c48778a27bcd866b6ce189b9d5f3ca508d933ec68f01580913960e151a2a40_s390x |
| Red Hat | openshift4/ose-cluster-baremetal-operator-rhel8@sha256:aebe52b19d2a258fe5ad6667bb3f2ab1618a8d33b7ae07a39d4866f798458049_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-cluster-baremetal-operator-rhel8@sha256:aebe52b19d2a258fe5ad6667bb3f2ab1618a8d33b7ae07a39d4866f798458049_ppc64le |
…and 51 more
Timeline
- Oct 4, 2023 CVE Published
- Apr 24, 2026 CVE Updated
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:5390 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2189886 issue
- https://issues.redhat.com/browse/OCPBUGS-10992 advisory
- https://issues.redhat.com/browse/OCPBUGS-16376 advisory
- https://issues.redhat.com/browse/OCPBUGS-19045 advisory
- https://issues.redhat.com/browse/OCPBUGS-19405 advisory
- https://issues.redhat.com/browse/OCPBUGS-19511 advisory
- https://issues.redhat.com/browse/OCPBUGS-19557 advisory
- https://issues.redhat.com/browse/OCPBUGS-19770 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5390.json advisory
- https://access.redhat.com/security/cve/CVE-2023-2253 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-2253 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-2253 advisory
- https://www.openwall.com/lists/oss-security/2023/05/09/1 advisory