CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

UBUNTU-CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66564

Sigstore Timestamp Authority contains a vulnerability (CVE-2025-66564) where ParseJSONRequest and getContentType allocate O(n) bytes when handling untrusted input (an OID with many periods or a malformed Content-Type header). The issue is triggered by using strings.Split on untrusted data, leadin...

CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

Sigstore Timestamp Authority 安全漏洞

Sigstore Timestamp Authority is a RFC3161 timestamp authorization software from sigstore open source. A security vulnerability exists in Sigstore Timestamp Authority versions prior to 2.0.3, which stems from mishandling of untrusted data by the api.ParseJSONRequest and api.getContentType function...

PT-2025-49174

Name of the Vulnerable Software and Affected Versions Sigstore Timestamp Authority versions prior to 2.0.3 Description Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. The api.ParseJSONRequest and api.getContentType functions are susceptible to a denial-of-service issue...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: guac, sqlpad, thanos, trino, boring-registry, spire-server, chezmoi, grafana-agent-operator, rclone, terragrunt, tekton-chains, cosign, restic, secrets-store-csi-driver-provider-azure, hugo, rekor, zot, flux, py3-azure-identity, pulumi, sigstore-scaffolding, step-ca,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: atlantis, prometheus-beat-exporter-fips, q, confluent-common-docker, gitleaks, k9s, etcd-fips, ip-masq-agent, kafkaexporter, cue-fips, mongo-tools, cass-operator-fips-no-pvc-delete, jsonnet-bundler, secrets-store-csi-driver-provider-azure, src-fingerprint, tempo,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: wolfictl, kargo, guac, cloudflared, minio, temporal, frp, caddy, spire-server, oauth2-proxy, weaviate, kots, terragrunt, cosign, rabbitmq-messaging-topology-operator, rekor, zot, aactl, nerdctl, sigstore-scaffolding, step-ca, flux-source-controller, grpc-health-probe...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: k3d, kubeflow-fips, src, up, terraform-provider-sendgrid, conftest-fips, falcoctl-fips, smarter-device-manager-fips, terraform-provider-sendgrid-fips, aactl, dynamic-localpv-provisioner-fips, prometheus-adapter-fips, cortex, metrics-server-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: memcached-exporter, kubeflow-fips, atlantis, minio, ip-masq-agent, terraform-provider-sendgrid, nghttp2, aactl, prometheus-adapter-fips, prometheus-elasticsearch-exporter, envoy-ratelimit, cosign, gitness, pulumi, kube-state-metrics, flux-kustomize-controller, kaf,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: memcached-exporter, kubeflow-fips, atlantis, minio, ip-masq-agent, terraform-provider-sendgrid, nghttp2, aactl, prometheus-adapter-fips, prometheus-elasticsearch-exporter, envoy-ratelimit, cosign, gitness, pulumi, kube-state-metrics, flux-kustomize-controller, kaf,...

OESA-2022-1938 shim security update

Initial UEFI bootloader that handles chaining to a trusted full \ bootloader under secure boot environments. Security Fixes: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2021-1339)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2021-1104)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL...

Oracle Linux 8 : openssl (ELSA-2020-5476)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5476 advisory. - Fix CVE-2020-1971 ediparty null pointer dereference Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. No...

Amazon Linux AMI : openssl (ALAS-2020-1456)

The version of openssl installed on the remote host is prior to 1.0.2k-16.152. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1456 advisory. A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERALNAMEcmp...