CVE-2023-33199: malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Impact A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.
Patches This is fixed in v1.2.0 of Rekor.
Workarounds No
References Discovered by OSS-Fuzz
Other sources
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/sigstore/rekorto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
Rekorto a version that resolves this vulnerability.Fixed in v1.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33199?
The severity of CVE-2023-33199 is considered minimal as it primarily causes a panic in a thread but allows continued service operation.
How do I fix CVE-2023-33199?
To fix CVE-2023-33199, upgrade the Rekor package to version 1.2.0 or later.
What systems are affected by CVE-2023-33199?
CVE-2023-33199 affects the Rekor software, specifically versions prior to 1.2.0.
What type of vulnerability is CVE-2023-33199?
CVE-2023-33199 is a denial of service vulnerability caused by malformed input.
What happens if CVE-2023-33199 is exploited?
If CVE-2023-33199 is exploited, it results in a service thread panic, leading to a 500 error message, but does not significantly disrupt availability.