CVE-2025-66564

{"id": "CVE-2025-66564", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66564", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T14:55:44.658584Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sigstore", "product": "timestamp-authority", "versions": [{"status": "affected", "version": "< 2.0.3"}]}]}], "published": "2025-12-04T23:15:47.430", "references": [{"url": "https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3."}, {"lang": "es", "value": "Sigstore Timestamp Authority es un servicio para emitir marcas de tiempo RFC 3161. Versiones anteriores a 2.0.3, la funci\u00f3n API.ParseJSONRequest actualmente divide (mediante una llamada a strings.Split) un OID proporcionado opcionalmente (que son datos no confiables) por puntos. De manera similar, la funci\u00f3n API.getContentType divide el encabezado Content-Type (que tambi\u00e9n son datos no confiables) por una cadena de aplicaci\u00f3n. Como resultado, ante una solicitud maliciosa con un OID excesivamente largo en la carga \u00fatil que contiene muchos caracteres de punto o un encabezado Content-Type malformado, una llamada a API.ParseJSONRequest o API.getContentType incurre en asignaciones de O(n) bytes (donde n representa la longitud del argumento de la funci\u00f3n). Esta vulnerabilidad se corrige en 2.0.3."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:sigstore_timestamp_authority:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D8EA727-11A8-4D61-8E22-F87608DA7009", "versionEndExcluding": "2.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}