-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/sigstore/timestamp-authority | go | <= 2.0.2 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in two functions, api.ParseJSONRequest and api.getContentType, within the sigstore/timestamp-authority repository. Both functions were susceptible to excessive memory allocation, a vulnerability categorized under CWE-405: Asymmetric Resource Consumption. This was due to the unbounded use of strings.Split on user-controlled input.
In api.ParseJSONRequest, the TSAPolicyOID field from a JSON request was split by periods. An attacker could craft a request with a very long OID containing a large number of periods, causing the strings.Split function to create a very large slice of strings, leading to excessive memory allocation and a potential denial of service.
Similarly, in api.getContentType, the Content-Type HTTP header was split by the string "application/". A malicious user could send a request with a crafted Content-Type header containing numerous instances of "application/", triggering the same excessive memory allocation issue.
The patch for this vulnerability, found in commit 0cae34e197d685a14904e0bad135b89d13b69421, addresses these issues by replacing the unbounded strings.Split with strings.SplitN. This change limits the number of splits performed, thus mitigating the risk of excessive memory allocation. Additionally, a check on the number of separators was added before splitting the string.
api.ParseJSONRequestpkg/api/timestamp.go
api.getContentTypepkg/api/timestamp.go
A Semantic Attack on Google Gemini - Read the Latest Research