GitHub Advisoryadvisory · Go

GHSA-frqx-jfcm-6jjr malformed proposed intoto entries can cause a panic

MEDIUM Published 2023-05-26 Modified 2023-05-26 Official page ↗
Aliases
CVE-2023-33199
Ecosystem
Go
Packages
github.com/sigstore/rekor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-617
Reviewed
2023-05-26

Affected packages

• Go github.com/sigstore/rekor: < 1.2.0 → fixed in 1.2.0

Description

Impact A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. Patches This is fixed in v1.2.0 of Rekor. Workarounds No References Discovered by OSS-Fuzz

Related

Alias · CVE (1)

  • CVE-2023-33199 Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. vulnerability

Weakness · CWE (1)

  • CWE-617 Reachable Assertion weakness

References