Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcios metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Trusted Artifact Signer 1.2 | RedHat | rhtas/cosign-rhel9:sha256:8efb2c8f77e91d7a15063ddc6f7eca1226a494f0f9340590af6e3a2eb9c462c3 | * |
| Red Hat Trusted Artifact Signer 1.2 | RedHat | rhtas/gitsign-rhel9:sha256:4c59990381ce313cd845257e95fd2e910b3d84459c5b3c3aa09fce954a328101 | * |
| Red Hat Trusted Artifact Signer 1.2 | RedHat | rhtas/client-server-rhel9:sha256:47071a0613d6d262110af4ce6703ce99db72c7ab58e3a6051b82f3098b372a49 | * |
| Red Hat Trusted Artifact Signer 1.3 | RedHat | rhtas/cosign-rhel9:sha256:a8289d488491991d454a32784de19476f2c984917eb7a33b4544e55512f2747c | * |
| Red Hat Trusted Artifact Signer 1.3 | RedHat | rhtas/gitsign-rhel9:sha256:3c39718e61d13648afcb5b0f5741aa771caf9b2f8c52e4af9dfa0635d5b05894 | * |
| Red Hat Trusted Artifact Signer 1.3 | RedHat | rhtas/fulcio-rhel9:sha256:d876a5e41b8467cdde921032f2cd53e77bef99ebcd8b61d72a3ad411469ad352 | * |
| Golang-github-sigstore-fulcio | Ubuntu | plucky | * |