CVE-2023-30551: fallo de gravedad alta en sigstore rekor
Rekor's compressed archives can result in OOM conditions
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 1.1%
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
sigstore · rekorCVEs relacionadas — sigstore rekor
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-33199MEDIUMmalformed proposed intoto v0.0.2 entries can cause a panic in RekorEPSS 0.7%CVE-2026-48702HIGHRekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing LogicEPSS 0.5%CVE-2026-23831MEDIUMRekor COSE v0.0.1 Canonicalize crashes when passed empty MessageEPSS 0.4%CVE-2026-24117MEDIUMRekor affected by Server-Side Request Forgery (SSRF) via provided public key URLEPSS 0.4%