Medium severity · published May 26, 2023
CVE-2023-33199
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Rekor · Linuxfoundation
before 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33199
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33199
Patch
https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4
Vendor Advisory
https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
More from Rekor
7.5
CVE-2023-30551
Rekor is an open source software supply chain transparency log
5.3
CVE-2026-24117
Rekor is a software supply chain transparency log
5.3
CVE-2026-23831
Rekor is a software supply chain transparency log