CVE-2023-33199 - CVE House

Back to Database

Status published Medium CVE-2023-33199

malformed proposed intoto v0.0.2 entries can cause a panic in Rekor

5.3 CVSS

Vulnerability Description

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33199

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from sigstore

View All →

Sigstore Timestamp Authority allocates excessive memory during request parsing

Fulcio allocates excessive memory during token parsing

sigstore-python has insufficient validation of integration timestamp during verification

sigstore-java has a vulnerability with bundle verification

Vulnerability with bundle verification in sigstore-java

Affected Vendor

sigstore

View all reports →

Affected Software

rekor

Vulnerable Versions:

< 1.2.0

Timeline

Official Publish: May 26th, 2023

Last Modified: January 14th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1562 Impair Defenses

Defense Evasion

T1485 Data Destruction