Bug 1211790 (CVE-2023-33199) - VUL-0: CVE-2023-33199: rekor: malformed proposed intoto v0.0.2 entries can cause a panic
Summary: VUL-0: CVE-2023-33199: rekor: malformed proposed intoto v0.0.2 entries can ca...
Status: RESOLVED FIXED
Alias: CVE-2023-33199
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/367604/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-33199:5.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-05-29 06:48 UTC by Gianluca Gabrielli
Modified: 2023-06-15 08:30 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2023-05-29 06:48:46 UTC
Rekor's goals are to provide an immutable tamper resistant ledger of metadata
generated within a software projects supply chain. A malformed proposed entry of
the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process.
The thread is recovered so the client receives a 500 error message and service
still continues, so the availability impact of this is minimal. This has been
fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known
workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-33199
https://www.cve.org/CVERecord?id=CVE-2023-33199
https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4
https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
Comment 1 Gianluca Gabrielli 2023-05-29 06:54:09 UTC
Affected packages:
 - SUSE:SLE-15-SP4:Update/rekor
 - openSUSE:Factory/rekor
Comment 2 OBSbugzilla Bot 2023-05-30 10:35:02 UTC
This is an autogenerated message for OBS integration:
This bug (1211790) was mentioned in
https://build.opensuse.org/request/show/1089753 Factory / rekor
Comment 3 Marcus Meissner 2023-05-31 07:36:09 UTC
submitted to sp4 and facvtory
Comment 5 Maintenance Automation 2023-06-15 08:30:10 UTC
SUSE-SU-2023:2515-1: An update that solves one vulnerability and contains one feature can now be installed.

Category: security (moderate)
Bug References: 1211790
CVE References: CVE-2023-33199
Jira References: SLE-23476
Sources used:
openSUSE Leap 15.4 (src): rekor-1.2.1-150400.4.12.1
openSUSE Leap 15.5 (src): rekor-1.2.1-150400.4.12.1
Basesystem Module 15-SP4 (src): rekor-1.2.1-150400.4.12.1
Basesystem Module 15-SP5 (src): rekor-1.2.1-150400.4.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.