CVE-2023-33199
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-33199- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2023-1532
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-1532- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frqx-jfcm-6jjr
malformed proposed intoto entries can cause a panic
Impact
A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.
Patches
This is fixed in v1.2.0 of Rekor.
Workarounds
No
References
Discovered by OSS-Fuzz
- Record
GHSA-frqx-jfcm-6jjr- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-33199- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-33199- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVGHSA-frqx-jfcm-6jjr
malformed proposed intoto entries can cause a panic
Impact
A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.
Patches
This is fixed in v1.2.0 of Rekor.
Workarounds
No
References
Discovered by OSS-Fuzz
- Record
GHSA-frqx-jfcm-6jjr- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617
- Updated
- 2026-11-02
Show 4 moreShow less
OSVAZL-26947 No score
CVE-2023-33199 for package skopeo is not applicable
This CVE either no longer is or was never applicable.
- Record
AZL-26947- Updated
- 2026-11-02
OSVGO-2023-1795 No score
malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
- Record
GO-2023-1795- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12965-1 No score
rekor-1.2.1-1.1 on GA media
These are all security issues fixed in the rekor-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12965-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2515-1 No score
Security update for rekor
This update for rekor fixes the following issues:
-
updated to rekor 1.2.1 (jsc#SLE-23476):
-
CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790).
- Record
SUSE-SU-2023:2515-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/sigstore/rekorGo |
before 1.2.0 | 1.2.0 |
rekorSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 1.2.1-150400.4.12.1 | 1.2.1-150400.4.12.1 |
rekorSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 1.2.1-150400.4.12.1 | 1.2.1-150400.4.12.1 |
rekoropenSUSE:Leap 15.4 |
before 1.2.1-150400.4.12.1 | 1.2.1-150400.4.12.1 |
rekoropenSUSE:Leap 15.5 |
before 1.2.1-150400.4.12.1 | 1.2.1-150400.4.12.1 |
rekoropenSUSE:Tumbleweed |
before 1.2.1-1.1 | 1.2.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33199 is a medium vulnerability (CVSS 5.3) in Linuxfoundation Rekor, published May 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in github.com/sigstore/rekor 1.2.0.
References
github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
nvd.nist.gov/vuln/detail/CVE-2023-33199
suse.com/support/update/announcement/2023/suse-su-20232515-1
bugzilla.suse.com/1211790