Allocation of Resources Without Limits or Throttling Affecting kpt package, versions <1.0.0_beta31-r5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-WOLFILATEST-KPT-5847190
- published 21 Aug 2023
- disclosed 6 Jun 2023
Introduced: 6 Jun 2023
CVE-2023-2253 Open this link in a new tabHow to fix?
Upgrade Wolfi kpt to version 1.0.0_beta31-r5 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kpt package and not the kpt package as distributed by Wolfi.
See How to fix? for Wolfi relevant fixed versions and status.
A flaw was found in the /v2/_catalog endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: n). This vulnerability allows a malicious user to submit an unreasonably large value for n, causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.