linuxfoundation fulcio güvenlik açıkları (CVE)

linuxfoundation fulcio için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

2 sonuç

5.8Orta

CVE-2026-22772 10 ay önce

Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

sigstore fulcio

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbi…

7.5Yüksek

CVE-2025-66506 11 ay önce

Fulcio allocates excessive memory during token parsing

sigstore fulcio

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on period…