{"id":"CVE-2023-33199","aliases":["AZL-26947","EUVD-2023-1532","GHSA-frqx-jfcm-6jjr","GO-2023-1795","SUSE-SU-2023:2515-1","openSUSE-SU-2024:12965-1"],"status":"published","title":"malformed proposed intoto v0.0.2 entries can cause a panic in Rekor","description":"Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0067,"percentile":0.52268,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2023-05-26T19:39:03Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Go","package":"github.com/sigstore/rekor","fixed_in":["1.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"rekor","fixed_in":["1.2.1-150400.4.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"rekor","fixed_in":["1.2.1-150400.4.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"rekor","fixed_in":["1.2.1-150400.4.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rekor","fixed_in":["1.2.1-150400.4.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rekor","fixed_in":["1.2.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/sigstore/rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/rekor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/rekor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150400.4.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150400.4.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150400.4.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-150400.4.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rekor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]}],"products":[{"vendor":"linuxfoundation","product":"rekor"},{"vendor":"sigstore","product":"rekor"}],"references":[{"url":"https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33199","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-frqx-jfcm-6jjr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33199.json","tags":["advisory"]},{"url":"https://github.com/sigstore/rekor","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211790","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-33199","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-33199","title":"malformed proposed intoto v0.0.2 entries can cause a panic in Rekor","description":"Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-05-26T22:52:15.973Z","modified":"2025-01-14T19:07:53.63Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:35:34.170609Z"}],"euvd":[{"id":"EUVD-2023-1532","description":"Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-05-26T22:52:15Z","modified":"2025-01-14T19:07:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:19.424496Z"}],"ghsa":[{"id":"GHSA-frqx-jfcm-6jjr","title":"malformed proposed intoto entries can cause a panic","description":"### Impact\nA malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.\n\n### Patches\nThis is fixed in v1.2.0 of Rekor.\n\n### Workarounds\nNo\n\n### References\nDiscovered by OSS-Fuzz","status":"published","published":"2023-05-26T19:39:03Z","modified":"2023-11-04T05:04:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-33199","description":"Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-05-26T23:15:18.96Z","modified":"2026-06-17T06:01:17.55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-33199","title":"malformed proposed intoto v0.0.2 entries can cause a panic in Rekor","description":"Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2023-05-26T22:52:15.973Z","modified":"2026-10-28T02:30:35.303608214Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"GHSA-frqx-jfcm-6jjr","title":"malformed proposed intoto entries can cause a panic","description":"### Impact\nA malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.\n\n### Patches\nThis is fixed in v1.2.0 of Rekor.\n\n### Workarounds\nNo\n\n### References\nDiscovered by OSS-Fuzz","status":"published","published":"2023-05-26T19:39:03Z","modified":"2026-09-10T03:50:01.390734533Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"AZL-26947","title":"CVE-2023-33199 for package skopeo is not applicable","description":"This CVE either no longer is or was never applicable.","status":"withdrawn","published":"2026-04-21T04:23:58.850714Z","modified":"2026-04-21T04:23:58.850714Z","updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"GO-2023-1795","title":"malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor","description":"malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor","status":"published","published":"2024-08-20T20:31:32Z","modified":"2026-02-04T04:23:27.132264Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:12965-1","title":"rekor-1.2.1-1.1 on GA media","description":"These are all security issues fixed in the rekor-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:06.53251Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:2515-1","title":"Security update for rekor","description":"This update for rekor fixes the following issues:\n\n- updated to rekor 1.2.1 (jsc#SLE-23476):\n\n- CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790).\n","status":"published","published":"2023-06-15T05:07:56Z","modified":"2026-02-04T03:57:14.128886Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}