7.5

CVE-2023-30551: linuxfoundation rekor

CVSS: 7.5v3.1HighModified
AliasesSUSE-SU-2023:2210-1CGA-36j4-mjc8-3m89CGA-5473-p5h8-vx6r
Published 08-05-2023Last modified 29-01-2025
Open JSON

Vulnerability summary

CVE-2023-30551 is a high (CVSS 7.5) vulnerability in linuxfoundation rekor. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.05%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 11
CGA-3HHC-WP8W-CGRHCGA-6X49-4XFP-W4P8CGA-8577-2M79-FVJRCGA-859W-848C-VG5HCGA-C58G-7X4F-62RVCGA-HCR4-PWW3-J447

Timeline

  1. 08-05-2023
    PublishedVulnerability first disclosed.
  2. 29-01-2025
    Last modifiedVulnerability information updated.

Description

Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.05%

Chance of exploitation in the next 30 days

Percentile

64%

Versus all other CVEs

30-day change

0.00 pp

From 1.05% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard12 products
  • aactl< 0.4.12-r7
  • apko< 0.8.0-r1
  • ko< 0.13.0-r3
  • rekorAll versions (No fix recorded)
  • rekor-backfill-indexAll versions (No fix recorded)
Wolfi8 products
  • aactl< 0.4.12-r7
  • apko< 0.8.0-r1
  • ko< 0.13.0-r3
  • rekorAll versions (No fix recorded)
  • rekor-backfill-indexAll versions (No fix recorded)
Opensuse2 products
  • rekor&distro=openSUSE Leap 15.4< 1.1.1-150400.4.9.1
  • rekor&distro=openSUSE Tumbleweed< 1.1.1-2.1
Github.com/sigstore1 product
  • rekor< 1.1.1
Linuxfoundation1 product
Sigstore1 product
Suse1 product
  • rekor&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 1.1.1-150400.4.9.1

7 vendors · 26 products

References

9 links