GHSA-4qg8-fj49-pxjh Sigstore Timestamp Authority allocates excessive memory during request parsing

• Go github.com/sigstore/timestamp-authority: < 2.0.3 → fixed in 2.0.3

Impact Excessive memory allocation Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the `Content-Type` header (which is also untrusted data) on an `application` string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed `Content-Type` header, a call to `api.ParseJSONRequest` or `api.getContentType` incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification) Patches Upgrade to v2.0.3. Workarounds There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.