Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fulcio allocates excessive memory during token parsing
Vulnerability Description
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
不对称的资源消耗(放大攻击)
Vulnerability Title
Fulcio 安全漏洞
Vulnerability Description
Fulcio是sigstore开源的一个证书颁发机构。 Fulcio 1.8.3之前版本存在安全漏洞，该漏洞源于identity.extractIssuerURL函数处理不当，可能导致内存分配问题。
CVSS Information
N/A
Vulnerability Type
N/A