Denial Of Service (DoS)

2023-05-1104:13:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

denial of service

out of memory

application crash

archive metadata

0.001 Low

EPSS

Percentile

50.3%

JSON

github.com/sigstore/rekor is vulnerable to Denial Of Service (DoS). The vulnerability exists because the archive metadata file size is not checked before the files are read to memory which can lead to out of memory conditions resulting in an application crash.

CPENameOperatorVersion
github.com/sigstore/rekoreqHEAD
github.com/sigstore/rekorlev1.1.0
rekor:edgeeq1.0.1-r2
rekor:edgeeq1.0.1-r3
rekor:edgeeq0.10.0-r2
rekor:edgeeq1.1.0-r1
rekor:edgeeq0.5.0-r2
rekor:edgeeq0.3.0-r0
rekor:edgeeq1.0.1-r4
rekor:edgeeq0.12.0-r2

Name	Operator	Version
github.com/sigstore/rekor	eq	HEAD
github.com/sigstore/rekor	le	v1.1.0
rekor:edge	eq	1.0.1-r2
rekor:edge	eq	1.0.1-r3
rekor:edge	eq	0.10.0-r2
rekor:edge	eq	1.1.0-r1
rekor:edge	eq	0.5.0-r2
rekor:edge	eq	0.3.0-r0
rekor:edge	eq	1.0.1-r4
rekor:edge	eq	0.12.0-r2