Sigstore Timestamp Authority vulnerabilities

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.

A vulnerability in Sigstore Timestamp Authority before version 2.1.0 allows an unauthenticated remote attacker to send requests with random paths or HTTP methods, causing unbounded permanent time-series entries in Prometheus metrics and leading to memory exhaustion.

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, the functions api.ParseJSONRequest and api.getContentType split untrusted data (an optional OID or the Content-Type header) on period or application strings, causing O(n)-byte allocations when handling a malicious request with an excessively long OID or malformed Content-Type header. This vulnerability is fixed in 2.0.3.