CVE-2023-30551 Rekor's compressed archives can result in OOM conditions

What is CVE-2023-30551?

CVE-2023-30551 is a high-severity vulnerability in sigstore rekor, published on 8 May 2023.

Official description

Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.

Weakness: CWE-770

Which versions are affected by CVE-2023-30551?

3 open source packages ship an affected version, including github.com/sigstore/rekor. It affects 1 product.

Products include Linuxfoundation Rekor.

How do I fix CVE-2023-30551?

Upgrade github.com/sigstore/rekor to 1.1.1 or later.

Is CVE-2023-30551 being exploited?

There is no known exploitation of CVE-2023-30551 in the wild and no public exploit code.

Other vulnerabilities in sigstore rekor

• CVE-2026-23831 Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message Medium 5.3
• CVE-2026-24117 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL Medium 5.3
• CVE-2023-33199 malformed proposed intoto v0.0.2 entries can cause a panic in Rekor Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2h5h-59f5-c5x9, GO-2023-1754, SUSE-SU-2023:2210-1, openSUSE-SU-2024:12919-1.