{"schemaVersion":3,"id":"CVE-2023-30551","aliases":["SUSE-SU-2023:2210-1","CGA-36j4-mjc8-3m89","CGA-5473-p5h8-vx6r","CGA-5wwr-743v-fj23","CGA-6gqv-9rvr-rgg9","CGA-742h-64rv-j5xf","CGA-9jcf-5wx4-jh7h","CGA-cwxp-6r2c-cv9f","CGA-j7mv-g3hh-hv6w","CGA-jq8q-6h62-jwpw","CGA-mc2q-p35w-4hh2","CGA-mmqq-cfjg-79p7","CGA-mqvx-cwhx-qv7x","CGA-r32j-rc8q-4m55","CGA-r58x-94q3-f9vp","CGA-rw98-x93x-x7w4","CGA-xmx5-g77v-74p9","GHSA-2h5h-59f5-c5x9","GO-2023-1754","openSUSE-SU-2024:12919-1","CGA-2frh-jm4r-3jvh","CGA-325p-pq9v-2qrj","CGA-4rx6-pxjv-r3r3","CGA-fvhf-pgwh-xx7g","CGA-h8rf-c2rp-x6rj","CGA-p9qv-cjfw-qw24","CGA-qwqx-6qgw-384j","CGA-w898-wjp9-h6cq"],"status":"published","duplicateOf":null,"title":null,"description":"Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.","dates":{"published":"2023-05-08T15:52:42.446Z","modified":"2025-01-29T15:30:31.064Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0105,"percentile":0.63723,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0105},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0105,"percentile":0.63723}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0105,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0105,"percentile":0.63723}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apko","name":"apko","label":"apko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apko","purlType":"apk","versions":[{"text":"< 0.8.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ko","name":"ko","label":"ko","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ko","purlType":"apk","versions":[{"text":"< 0.13.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor","name":"rekor","label":"rekor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-backfill-index","name":"rekor-backfill-index","label":"rekor-backfill-index","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-backfill-index","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-cli","name":"rekor-cli","label":"rekor-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-cli","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-fips","name":"rekor-fips","label":"rekor-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-fips-backfill-index","name":"rekor-fips-backfill-index","label":"rekor-fips-backfill-index","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-fips-backfill-index","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-fips-cli","name":"rekor-fips-cli","label":"rekor-fips-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-fips-cli","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-fips-server","name":"rekor-fips-server","label":"rekor-fips-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-fips-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rekor-server","name":"rekor-server","label":"rekor-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rekor-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tkn","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"aactl","name":"aactl","label":"aactl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/aactl","purlType":"apk","versions":[{"text":"< 0.4.12-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.12-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apko","name":"apko","label":"apko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apko","purlType":"apk","versions":[{"text":"< 0.8.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ko","name":"ko","label":"ko","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ko","purlType":"apk","versions":[{"text":"< 0.13.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor","name":"rekor","label":"rekor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-backfill-index","name":"rekor-backfill-index","label":"rekor-backfill-index","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-backfill-index","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-cli","name":"rekor-cli","label":"rekor-cli","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-cli","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rekor-server","name":"rekor-server","label":"rekor-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rekor-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tkn","name":"tkn","label":"tkn","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tkn","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/sigstore","product":"rekor","name":"github.com/sigstore/rekor","label":"rekor","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/sigstore/rekor","purlType":"golang","versions":[{"text":"< 1.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1","eol":null,"hubHref":null},{"vendor":"linuxfoundation","product":"rekor","name":"rekor","label":"rekor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1","eol":null,"hubHref":"/vendor/linuxfoundation/rekor"},{"vendor":"opensuse","product":"rekor&distro=openSUSE Leap 15.4","name":"rekor","label":"rekor&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rekor&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 1.1.1-150400.4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1-150400.4.9.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"rekor&distro=openSUSE Tumbleweed","name":"rekor","label":"rekor&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rekor&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.1.1-2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1-2.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rekor&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","name":"rekor","label":"rekor&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rekor&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","purlType":"rpm","versions":[{"text":"< 1.1.1-150400.4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1-150400.4.9.1","eol":null,"hubHref":null},{"vendor":"sigstore","product":"rekor","name":"rekor","label":"rekor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.1","eol":null,"hubHref":"/vendor/sigstore/rekor"}],"affectedCount":26,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9","label":"github.com/sigstore/rekor/security/advisories/GHSA-2h5h-59f5-c5x9","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Vendor Advisory"]},{"url":"https://github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48","label":"github.com/sigstore/rekor/commit/cf42ace82667025fe128f7a50cf6b4cdff51cc48","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/sigstore/rekor/releases/tag/v1.1.1","label":"github.com/sigstore/rekor/releases/tag/v1.1.1","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232210-1/","label":"www.suse.com/support/update/announcement/2023/suse-su-20232210-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1211210","label":"bugzilla.suse.com/1211210","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30551","label":"www.suse.com/security/cve/CVE-2023-30551","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30551.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30551.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30551","label":"nvd.nist.gov/vuln/detail/CVE-2023-30551","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/sigstore/rekor","label":"github.com/sigstore/rekor","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-3HHC-WP8W-CGRH","CGA-6X49-4XFP-W4P8","CGA-8577-2M79-FVJR","CGA-859W-848C-VG5H","CGA-C58G-7X4F-62RV","CGA-HCR4-PWW3-J447","CGA-J8X4-2XG6-57V8","CGA-Q4C7-GG9Q-XF29","CGA-VF8G-7W98-M5GJ","CGA-VGC4-GMRG-RW7G","CGA-WCW5-P26F-2QQQ"]},"timeline":[{"kind":"published","date":"2023-05-08T15:52:42.446Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-01-29T15:30:31.064Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:41:55.557Z","stale":false,"partial":false}}