CVE-2023-33199 malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Malformed intoto entries cause a panic in Rekor, resulting in a 500 error and minimal availability impact for supply chain metadata services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-33199?
CVE-2023-33199 is a medium-severity denial of service vulnerability in sigstore rekor, published on 26 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-617
Which versions are affected by CVE-2023-33199?
3 open source packages ship an affected version, including github.com/sigstore/rekor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/rekor Go | All versions | 1.2.0 |
github.com/sigstore/rekor Go | All versions | 1.2.0 |
github.com/sigstore/rekor Go | All versions | 1.2.0 |
Linux distribution packages (5)
rekor SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.2.1-150400.4.12.1 |
rekor SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.2.1-150400.4.12.1 |
rekor openSUSE:Leap 15.4 | All versions | 1.2.1-150400.4.12.1 |
rekor openSUSE:Leap 15.5 | All versions | 1.2.1-150400.4.12.1 |
rekor openSUSE:Tumbleweed | All versions | 1.2.1-1.1 |
Products include Linuxfoundation Rekor.
How do I fix CVE-2023-33199?
Upgrade github.com/sigstore/rekor to 1.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-33199 being exploited?
There is no known exploitation of CVE-2023-33199 in the wild and no public exploit code.
Other vulnerabilities in sigstore rekor
Sources
Also known as GHSA-frqx-jfcm-6jjr, GO-2023-1795, SUSE-SU-2023:2515-1, openSUSE-SU-2024:12965-1.