CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

UBUNTU-CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority contains a vulnerability (CVE-2025-66564) where ParseJSONRequest and getContentType allocate O(n) bytes when handling untrusted input (an OID with many periods or a malformed Content-Type header). The issue is triggered by using strings.Split on untrusted data, leadin...

Sigstore Timestamp Authority 安全漏洞

Sigstore Timestamp Authority is a RFC3161 timestamp authorization software from sigstore open source. A security vulnerability exists in Sigstore Timestamp Authority versions prior to 2.0.3, which stems from mishandling of untrusted data by the api.ParseJSONRequest and api.getContentType function...

PT-2025-49174

Name of the Vulnerable Software and Affected Versions Sigstore Timestamp Authority versions prior to 2.0.3 Description Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. The api.ParseJSONRequest and api.getContentType functions are susceptible to a denial-of-service issue...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: trino, goreleaser, chezmoi, trivy, py3-cassandra-medusa, nuclei, sops, terragrunt, timestamp-authority, hugo, opentelemetry-collector, spire-server, tekton-chains, buildkitd, bank-vaults, grafana-mimir, flux, druid, prometheus-operator, fulcio, thanos,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: skaffold, flannel, external-secrets-fips, multus-cni-fips, newrelic-nri-statsd, bank-vaults-fips, smarter-device-manager, prometheus-alertmanager-fips, gitness, kubernetes-csi-livenessprobe, addon-resizer-fips, aws-load-balancer-controller-fips,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: goreleaser, frp, oauth2-proxy, sops, skaffold, melange, gitsign, spire-server, terragrunt, aactl, cloudflared, bank-vaults, gomplate, tekton-chains, rabbitmq-messaging-topology-operator, fulcio, wolfictl, rook, minio, weaviate, kube-rbac-proxy, kubernetes-dashboard,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, buildkitd, slsa-verifier, kiam, bank-vaults-fips, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner-fips, prometheus-adapter-fips, terraform-provider-sendgrid, prometheus-blackbox-exporter, aactl, up, cortex, k3d, scorecard,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: skaffold, bank-vaults-fips, gitness, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner-fips, prometheus-blackbox-exporter, metrics-server, spark-operator, flux-kustomize-controller, atlantis, dgraph, kubewatch, ollama, pulumi-kubernetes-operator, atlantis-fip...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: skaffold, bank-vaults-fips, gitness, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner-fips, prometheus-blackbox-exporter, metrics-server, spark-operator, flux-kustomize-controller, atlantis, dgraph, kubewatch, ollama, pulumi-kubernetes-operator, atlantis-fip...

OESA-2022-1938 shim security update

Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2021-1339)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2021-1104)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL...

Oracle Linux 8 : openssl (ELSA-2020-5476)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5476 advisory. - Fix CVE-2020-1971 ediparty null pointer dereference Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...

Amazon Linux AMI : openssl (ALAS-2020-1456)

The version of openssl installed on the remote host is prior to 1.0.2k-16.152. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1456 advisory. A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERALNAMEcmp...