Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Summary

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Why it matters

GitHub has published a reviewed security advisory for github.com/sigstore/rekor. Prioritize it with other application dependency updates.

Operator check

Check whether github.com/sigstore/rekor is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available.

Sources