Security update for rekor SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2515-1 Final 1 1 2023-06-15T05:07:56Z current 2023-06-15T05:07:56Z 2023-06-15T05:07:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rekor This update for rekor fixes the following issues: - updated to rekor 1.2.1 (jsc#SLE-23476): - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2515,SUSE-SLE-Module-Basesystem-15-SP4-2023-2515,SUSE-SLE-Module-Basesystem-15-SP5-2023-2515,openSUSE-SLE-15.4-2023-2515,openSUSE-SLE-15.5-2023-2515 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232515-1/ Link for SUSE-SU-2023:2515-1 https://lists.suse.com/pipermail/sle-updates/2023-June/029895.html E-Mail link for SUSE-SU-2023:2515-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211790 SUSE Bug 1211790 https://www.suse.com/security/cve/CVE-2023-33199/ SUSE CVE CVE-2023-33199 page SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 openSUSE Leap 15.4 openSUSE Leap 15.5 rekor-1.2.1-150400.4.12.1 rekor-1.2.1-150400.4.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 rekor-1.2.1-150400.4.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 rekor-1.2.1-150400.4.12.1 as a component of openSUSE Leap 15.4 rekor-1.2.1-150400.4.12.1 as a component of openSUSE Leap 15.5 Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-33199 SUSE Linux Enterprise Module for Basesystem 15 SP4:rekor-1.2.1-150400.4.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:rekor-1.2.1-150400.4.12.1 openSUSE Leap 15.4:rekor-1.2.1-150400.4.12.1 openSUSE Leap 15.5:rekor-1.2.1-150400.4.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232515-1/ https://www.suse.com/security/cve/CVE-2023-33199.html CVE-2023-33199 https://bugzilla.suse.com/1211790 SUSE Bug 1211790