CVE-2023-33199 json
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
published 2023-05-26 3 y ago modified 2026-09-10 1 mo ago also GHSA-frqx-jfcm-6jjr , GO-2023-1795 , EUVD-2023-1532
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- go github.com/sigstore/rekor 1.2.0
- linuxfoundation rekor 1.2.0
- rekor SLE Module for Basesystem 15 SP5, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.5 +1 more 1.2.1-150400.4.12.1
suse advisories SUSE-SU-2023:2515-1
- rekor openSUSE Tumbleweed 1.2.1-1.1
opensuse advisories openSUSE-SU-2024:12965-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/sigstore/rekor | <1.2.0 |
1.2.0 |
Affected products
- sigstore rekor
Classification
- Weakness
-
- CWE-617 Reachable Assertion
References
-
github.com
/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4
web, patch
-
github.com
/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-33199
advisory
-
github.com
/sigstore/rekor
package
Sources
- CVE List CVE-2023-33199
- GitHub Advisory GHSA-frqx-jfcm-6jjr
- NVD CVE-2023-33199
- OSV GO-2023-1795
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.