Sigstore Fulcio Excessive Memory Allocation Vulnerability in OIDC Token Parsing

A vulnerability in Sigstore Fulcio prior to version 1.8.3 allows for excessive memory allocation during the parsing of OpenID Connect (OIDC) identity tokens. The issue arises in the 'identity.extractIssuerURL' function, which splits untrusted data on period characters. This flaw can be exploited by sending a malicious OIDC token containing numerous periods, leading to memory allocations proportional to the token's length, with a constant overhead. This behavior creates an asymmetric resource consumption issue, amplifying the impact on availability.

Impact

Exploitation of this vulnerability causes excessive memory allocation, which can lead to denial-of-service conditions by exhausting available system resources.

Remediation

Users can upgrade to Sigstore Fulcio version 1.8.3 or later to address this vulnerability.