PT-2024-31599 · Unknown · Sigstore-Go

Adamkorcz

·

Published

2024-09-04

·

Updated

2024-09-24

·

CVE-2024-45395

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: sigstore-go versions prior to 0.6.1
Description: The issue is related to a denial of service attack that can occur when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data. This data can be in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these data structures is computationally expensive and can be used to consume excessive CPU resources, leading to a denial of service attack. This type of vulnerability is labeled as an "Endless data attack" by TUF's security model and can lead to verification failing to complete and disrupting services that rely on sigstore-go for verification.
Recommendations: For versions prior to 0.6.1, upgrade to sigstore-go 0.6.1 or later to address the vulnerability. As a temporary workaround for users who are vulnerable but unable to quickly upgrade, consider adding manual bundle validation to enforce limits similar to those in the referenced patch prior to calling sigstore-go's verification functions.

Exploit

Fix

Infinite Loop

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2024-45395
GHSA-CQ38-JH5F-37MQ
GO-2024-3116

Affected Products

Sigstore-Go