CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

UBUNTU-CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority contains a vulnerability (CVE-2025-66564) where ParseJSONRequest and getContentType allocate O(n) bytes when handling untrusted input (an OID with many periods or a malformed Content-Type header). The issue is triggered by using strings.Split on untrusted data, leadin...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

Sigstore Timestamp Authority 安全漏洞

Sigstore Timestamp Authority is a RFC3161 timestamp authorization software from sigstore open source. A security vulnerability exists in Sigstore Timestamp Authority versions prior to 2.0.3, which stems from mishandling of untrusted data by the api.ParseJSONRequest and api.getContentType function...

PT-2025-49174

Name of the Vulnerable Software and Affected Versions Sigstore Timestamp Authority versions prior to 2.0.3 Description Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. The api.ParseJSONRequest and api.getContentType functions are susceptible to a denial-of-service issue...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: boring-registry, sops, opentelemetry-collector, timestamp-authority, chezmoi, zot, py3-azure-identity, tempo, falcoctl, flyte, step, goreleaser, velero, flux, spire-server, step-ca, pulumi, rook, argo-events, grafana-agent-operator, hugo, k8sgpt,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: falcoctl, conftest-fips, cri-tools, falcosidekick-fips, kustomize, nfs-subdir-external-provisioner, prometheus-beat-exporter, opentelemetry-collector-contrib-fips, prometheus-postgres-exporter-fips, regclient, shfmt, jitsucom-bulker, logstash-exporter, step-fips,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: nerdctl, sops, gitsign, timestamp-authority, slsa-verifier, zot, caddy, frp, grpc-health-probe, falcoctl, vexctl, melange, ko, skaffold, dex, skopeo, step, minio, k3s, goreleaser, spire-server, step-ca, rook, dgraph, sigstore-scaffolding, cloudflared, aactl,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: conftest-fips, terraform-provider-sendgrid-fips, slsa-verifier, prometheus-adapter-fips, kubernetes-csi-livenessprobe, kubeflow-fips, dgraph, kubernetes-csi-livenessprobe-fips, metrics-server-fips, plutono-fips, volume-modifier-for-k8s-fips, vault-csi-provider,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, slsa-verifier, kubernetes-csi-livenessprobe, gke-gcloud-auth-plugin, ko, prometheus-elasticsearch-exporter, vault-csi-provider, atlantis-fips, flux-helm-controller, hey, cue, frp, kpt, mc, minio, configmap-reload-fips, rqlite, kiam,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, slsa-verifier, kubernetes-csi-livenessprobe, gke-gcloud-auth-plugin, ko, prometheus-elasticsearch-exporter, vault-csi-provider, atlantis-fips, flux-helm-controller, hey, cue, frp, kpt, mc, minio, configmap-reload-fips, rqlite, kiam,...

OESA-2022-1938 shim security update

Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2021-1339)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2021-1104)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL...

Oracle Linux 8 : openssl (ELSA-2020-5476)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5476 advisory. - Fix CVE-2020-1971 ediparty null pointer dereference Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...

Amazon Linux AMI : openssl (ALAS-2020-1456)

The version of openssl installed on the remote host is prior to 1.0.2k-16.152. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1456 advisory. A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERALNAMEcmp...