CVE-2023-2253: redhat openshift_api_for_data_protection Undefined Behavior for Input to API
Vulnerability summary
CVE-2023-2253 is a medium (CVSS 6.5) Undefined Behavior for Input to API vulnerability in redhat openshift_api_for_data_protection. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 14Timeline
- 06-06-2023PublishedVulnerability first disclosed.
- 07-01-2025Last modifiedVulnerability information updated.
Description
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.94%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.94% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-475Undefined Behavior for Input to APIThe behavior of this function is undefined unless its control parameter is set to a specific value.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard6 products
- aactl< 0.4.12-r7
- argocd-image-updater< 0.17.0-r1
- argocd-image-updater-fips< 0.17.0-r2
- bom< 0.6.0-r0
- kpt< 1.0.0_beta31-r5
Wolfi5 products
- aactl< 0.4.12-r7
- argocd-image-updater< 0.17.0-r1
- bom< 0.6.0-r0
- kpt< 1.0.0_beta31-r5
- kubernetes-dashboard< 2.7.0-r2
Redhat3 products
Opensuse2 products
- distribution-registry&distro=openSUSE Tumbleweed< 2.8.2-1.1
- distribution&distro=openSUSE Leap 15.4< 2.8.1-150400.9.18.1 | < 2.8.2-150400.9.21.1
Suse2 products
- distribution&distro=SUSE Linux Enterprise Module for Containers 15 SP4< 2.8.1-150400.9.18.1 | < 2.8.2-150400.9.21.1
- docker-distribution&distro=SUSE Linux Enterprise Module for Containers 12< 2.6.2-13.9.1
Debian1 product
- docker-registry< 2.7.1+ds2-7+deb11u1 | < 2.6.2~ds1-2+deb10u1 | < 2.8.2+ds1-1
Github.com/distribution1 product
- distribution< 2.8.2-beta.1+incompatible
Github.com/docker1 product
- distribution< 2.8.2-beta.1
Mageia1 product
- docker-registry< 2.8.2-1.mga8
Ubuntu1 product
- docker-registry< 2.3.0~ds1-1ubuntu0.1~esm1 | < 2.6.2~ds1-1ubuntu0.1~esm1 | < 2.7.1+ds2-7ubuntu0.3 | < 2.8.0+ds1-4ubuntu0.1~esm2
10 vendors · 23 products
