chore(deps): update module github.com/sigstore/timestamp-authority to v2 [security]#240
Merged
jrahme-cci merged 4 commits intomainfrom Jan 8, 2026
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/go-github.com-sigstore-timestamp-authority-vulnerability
branch
from
7ae1202 to
9f776b0
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
jrahme-cci
force-pushed
the
renovate/go-github.com-sigstore-timestamp-authority-vulnerability
branch
3 times, most recently
from
1729c39 to
86179fe
Compare
jrahme-cci
force-pushed
the
renovate/go-github.com-sigstore-timestamp-authority-vulnerability
branch
from
86179fe to
93ab3df
Compare
jrahme-cci
approved these changes
Jan 8, 2026
jrahme-cci
deleted the
renovate/go-github.com-sigstore-timestamp-authority-vulnerability
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.2.8→v2.0.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-66564
Impact
Excessive memory allocation
Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the
Content-Typeheader (which is also untrusted data) on anapplicationstring.As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed
Content-Typeheader, a call toapi.ParseJSONRequestorapi.getContentTypeincurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)Patches
Upgrade to v2.0.3.
Workarounds
There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.
Sigstore Timestamp Authority allocates excessive memory during request parsing
CVE-2025-66564 / GHSA-4qg8-fj49-pxjh / GO-2025-4192
More information
Details
Impact
Excessive memory allocation
Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the
Content-Typeheader (which is also untrusted data) on anapplicationstring.As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed
Content-Typeheader, a call toapi.ParseJSONRequestorapi.getContentTypeincurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)Patches
Upgrade to v2.0.3.
Workarounds
There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sigstore/timestamp-authority (github.com/sigstore/timestamp-authority)
v2.0.3Compare Source
Vulnerability Fixes
v2.0.2Compare Source
This release bumps the Go version to 1.25.
v2.0.1Compare Source
This release is identical to v2.0.0, as it only contains a fix for the release pipeline.
v2.0.0Compare Source
v2.0.0 changes the default HTTP response code to 200 for timestamp responses,
which matches all other well-known TSA implementations. Sigstore clients already
handle both 200 and 201 response codes, so no changes are needed to clients.
If you need backwards compatibility, you can deploy the service with
--use-http-201.This release also changes the format of the binary and container signature,
which is now a Sigstore bundle.
To verify a release, use the latest Cosign 3.x, verifying with
cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.Features
Testing
Documentation
Misc
v1.2.9Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.