Bugzilla – Bug 1211790
VUL-0: CVE-2023-33199: rekor: malformed proposed intoto v0.0.2 entries can cause a panic
Last modified: 2023-06-15 08:30:10 UTC
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33199 https://www.cve.org/CVERecord?id=CVE-2023-33199 https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4 https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
Affected packages: - SUSE:SLE-15-SP4:Update/rekor - openSUSE:Factory/rekor
This is an autogenerated message for OBS integration: This bug (1211790) was mentioned in https://build.opensuse.org/request/show/1089753 Factory / rekor
submitted to sp4 and facvtory
SUSE-SU-2023:2515-1: An update that solves one vulnerability and contains one feature can now be installed. Category: security (moderate) Bug References: 1211790 CVE References: CVE-2023-33199 Jira References: SLE-23476 Sources used: openSUSE Leap 15.4 (src): rekor-1.2.1-150400.4.12.1 openSUSE Leap 15.5 (src): rekor-1.2.1-150400.4.12.1 Basesystem Module 15-SP4 (src): rekor-1.2.1-150400.4.12.1 Basesystem Module 15-SP5 (src): rekor-1.2.1-150400.4.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.