Denial Of Service (DoS)

2024-04-1508:56:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

remote image

memory

attachment

vulnerability

attacker

crafted attachment

software

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

AI Score

4.3

Confidence

High

EPSS

Percentile

15.5%

JSON

github.com/sigstore/cosign is vulnerable to a Denial of Service (DoS). The vulnerability is due to reading the attachment from a remote image entirely into memory without checking the size of the attachment first. This flaw allows an attacker to trigger a Denial of Service via a large crafted attachment.