CVE-2023-33199 (Go, published 2023-05-26T23:15Z)
Description: value: Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/sigstore/rekor
Files changed:
pkg/generated/models/intoto_v002_schema.go
pkg/generated/restapi/embedded_spec.go
pkg/types/dsse/v0.0.1/entry.go
pkg/types/dsse/v0.0.1/entry_test.go
pkg/types/intoto/v0.0.2/entry.go
pkg/types/intoto/v0.0.2/entry_test.go
pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json
Commit message: Merge pull request from GHSA-frqx-jfcm-6jjr

* fix for ghsa-frqx-jfcm-6jjr

Signed-off-by: Bob Callaway <bcallaway@google.com>

* add defensive check

Signed-off-by: Bob Callaway <bcallaway@google.com>

* add defensive check to dsse type

Signed-off-by: Bob Callaway <bcallaway@google.com>

* be stricter for DSSE, add another defensive check

Signed-off-by: Bob Callaway <bcallaway@google.com>

---------

Signed-off-by: Bob Callaway <bcallaway@google.com>

Vulnerable code:
	PublicKey strfmt.Base64 `json:"publicKey,omitempty"`
	Sig strfmt.Base64 `json:"sig,omitempty"`
		keyObj, err := x509.NewPublicKey(bytes.NewReader(sig.PublicKey))
	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
			Sig:   string(sig.Sig),
		allPubKeyBytes = append(allPubKeyBytes, sig.PublicKey)
			Sig:       strfmt.Base64([]byte(sig.Sig)),
			PublicKey: keyBytes,
	return x509.NewPublicKey(bytes.NewReader(v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
		if len(sig.Sig) == 0 {
		if len(sig.PublicKey) == 0 {
			Sig:       strfmt.Base64([]byte(sig.Sig)),
			PublicKey: strfmt.Base64(pub[i]),
					keyHash := sha256.Sum256(sig.PublicKey)
				keyHash := sha256.Sum256(sig.PublicKey)
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig: strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
                                }

Fixed code:
	// Required: true
	PublicKey *strfmt.Base64 `json:"publicKey"`
	// Required: true
	Sig *strfmt.Base64 `json:"sig"`
	var res []error

	if err := m.validatePublicKey(formats); err != nil {
		res = append(res, err)
	}

	if err := m.validateSig(formats); err != nil {
		res = append(res, err)
	}

	if len(res) > 0 {
		return errors.CompositeValidationError(res...)
	}
	return nil
}

func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validatePublicKey(formats strfmt.Registry) error {

	if err := validate.Required("publicKey", "body", m.PublicKey); err != nil {
		return err
	}

	return nil
}

func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validateSig(formats strfmt.Registry) error {

	if err := validate.Required("sig", "body", m.Sig); err != nil {
		return err
	}

      "required": [
        "sig",
        "publicKey"
      ],
		if sig == nil || sig.Verifier == nil {
			return result, errors.New("missing or malformed public key")
		}
		if publicKey == nil {
			return errors.New("an invalid null verifier was provided in ProposedContent")
		}

	validEnv := envelope(t, key, []byte("payload"))
	validEnvBytes, _ := json.Marshal(validEnv)

		{
			env:  validEnv,
			name: "null verifier in array",
			it: &models.DSSEV001Schema{
				ProposedContent: &models.DSSEV001SchemaProposedContent{
					Envelope:  swag.String(string(validEnvBytes)),
					Verifiers: []strfmt.Base64{pub, nil},
				},
			},
			wantErr: true,
		},
	"golang.org/x/exp/slices"
		if sig == nil || sig.PublicKey == nil {
			return result, errors.New("malformed or missing signature")
		}
		keyObj, err := x509.NewPublicKey(bytes.NewReader(*sig.PublicKey))
	for i, sig := range v.IntotoObj.Content.Envelope.Signatures {
		if sig == nil {
			v.IntotoObj.Content.Envelope.Signatures = slices.Delete(v.IntotoObj.Content.Envelope.Signatures, i, i)
			continue
		}
			Sig:   string(*sig.Sig),
		allPubKeyBytes = append(allPubKeyBytes, *sig.PublicKey)
		sigBytes := strfmt.Base64([]byte(sig.Sig))
			Sig:       &sigBytes,
			PublicKey: &keyBytes,
	return x509.NewPublicKey(bytes.NewReader(*v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
		if sig == nil {
			return false, errors.New("missing signature entry")
		}
		if sig.Sig == nil || len(*sig.Sig) == 0 {
		if sig.PublicKey == nil || len(*sig.PublicKey) == 0 {
		keyBytes := strfmt.Base64(pub[i])
		sigBytes := strfmt.Base64([]byte(sig.Sig))
			Sig:       &sigBytes,
			PublicKey: &keyBytes,
	keyBytes := strfmt.Base64("key")
	sigBytes := strfmt.Base64("sig")
		{
			env:  envelope(t, key, []byte(validPayload)),
			name: "null array entry",
			it: &models.IntotoV002Schema{
				Content: &models.IntotoV002SchemaContent{
					Envelope: &models.IntotoV002SchemaContentEnvelope{
						Payload:     strfmt.Base64("cGF5bG9hZAo="),
						PayloadType: swag.String("payloadType"),
						Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
							{
								PublicKey: &keyBytes,
								Sig:       &sigBytes,
							},
							nil,
						},
					},
					Hash: &models.IntotoV002SchemaContentHash{
						Algorithm: swag.String(models.IntotoV002SchemaContentHashAlgorithmSha256),
						Value:     swag.String(envelopeHash(t, envelope(t, key, []byte(validPayload)))),
					},
				},
			},
			wantErr:         true,
			wantVerifierErr: true,
		},
					keyHash := sha256.Sum256(*sig.PublicKey)
				keyHash := sha256.Sum256(*sig.PublicKey)
	keyBytes := strfmt.Base64([]byte("key"))
	sigBytes := strfmt.Base64([]byte("sig"))
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig: &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
                                },
                                "required": ["sig", "publicKey"]