Sigstore Timestamp Authority allocates excessive memory during request parsing
Résumé
Sigstore Timestamp Authority allocates excessive memory during request parsing
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-66564 golang-github-sigstore-timestamp-authority
- Ubuntu UBUNTU-CVE-2025-66564 golang-github-sigstore-timestamp-authority
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com