Rekor's compressed archives can result in OOM conditions

CVE-2023-30551

What is CVE-2023-30551?

Rekor, an open-source tool for software supply chain transparency, is susceptible to crashes due to out of memory (OOM) conditions. This issue arises when the application processes large archive metadata files without adequately checking their sizes. Specifically, when verifying a JAR file or parsing an APK file, the presence of oversized files in the META-INF directory or the .SIGN and .PKGINFO files can lead to an OOM crash. The vulnerability has been resolved in Rekor version 1.1.1, with no known workarounds available.

References