CVE-2023-33199

Name of the Vulnerable Software and Affected Versions Rekor versions prior to 1.2.0

Description A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered, resulting in a 500 error message to the client, with minimal availability impact.

Recommendations For versions prior to 1.2.0, upgrade to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the intoto/v0.0.2 type proposed entries until a patch is applied.