CVE-2025-66564
Description
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
How to fix
- linuxfoundation sigstore_timestamp_authority2.0.3 or later
- github.com/sigstore/timestamp-authority2.0.3 or later
- github.com/sigstore/timestamp-authority/v22.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation sigstore_timestamp_authority | v < 2.0.3 | 2.0.3 |
| github.com/sigstore/timestamp-authorityGo | v < 2.0.3, No range specified | 2.0.3 |
| github.com/sigstore/timestamp-authority/v2Go | v < 2.0.3 | 2.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.