EUVD-2025-201319
GHSA-4qg8-fj49-pxjh
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
Analysis
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
Technical Context
This vulnerability is classified as Asymmetric Resource Consumption (Amplification) (CWE-405).
Affected Products
Affected products: Linuxfoundation Sigstore Timestamp Authority
Remediation
Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
Bug #1122060| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| trixie | vulnerable | 1.2.3-2 | - |
| forky, sid | fixed | 2.0.4-1 | - |
| (unstable) | fixed | 2.0.3-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today