id: GO-2023-1589
modules:
    - module: github.com/notaryproject/notation-go
      versions:
        - fixed: 1.0.0-rc.3
      vulnerable_at: 1.0.0-rc.1
      packages:
        - package: github.com/notaryproject/notation-go/internal/pkix
          symbols:
            - ParseDistinguishedName
        - package: github.com/notaryproject/notation-go/verifier
          symbols:
            - verifyX509TrustedIdentities
          derived_symbols:
            - New
            - NewFromConfig
            - verifier.Verify
        - package: github.com/notaryproject/notation-go/verifier/trustpolicy
          symbols:
            - validateTrustedIdentities
          derived_symbols:
            - Document.Validate
summary: Denial of service from memory exhaustion in github.com/notaryproject/notation-go
description: |
    Parsing PKIX distinguished names containing the string "=#" can
    cause excessive memory consumption.
cves:
    - CVE-2023-25656
ghsas:
    - GHSA-87x9-7grx-m28v
references:
    - fix: https://github.com/notaryproject/notation-go/pull/275