Описание
A flaw was found in Rekor. The Package.Unmarshal() function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints.
Отчет
A flaw was found in Rekor, a transparency log for supply chain security. The Alpine APK parsing logic decompresses gzip members without bounding total decompressed size, allowing a decompression bomb to cause out-of-memory conditions via unauthenticated API endpoints. This vulnerability is server-side only, affecting the Rekor server's APK entry processing. Products that import github.com/sigstore/rekor as a Go client library are not affected, as the vulnerable code path (Package.Unmarshal in pkg/types/alpine/apk.go) is only reachable through the Rekor server's HTTP API handlers.
Меры по смягчению последствий
There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression. Upgrade to Rekor 1.5.2 or later.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | assisted/agent-preinstall-image-builder-rhel9 | Not affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-must-gather-rhel9 | Not affected | ||
| Lightspeed Core | lightspeed-core/rag-tool-cpu-rhel9 | Not affected | ||
| Lightspeed Core | lightspeed-core/rag-tool-cuda-12.9-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Logical Volume Manager Storage | lvms4/lvms-must-gather-rhel9 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-controller-rhel8 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-log-reader-rhel8 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-must-gather-rhel8 | Not affected | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-must-gather-rhel8 | Not affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
7.5 High
CVSS3