Sigstore Timestamp Authority Prometheus Label Memory Exhaustion

Executive Summary

This vulnerability in Sigstore Timestamp Authority allows unauthenticated remote attackers to cause server-side memory exhaustion by sending requests with random paths or HTTP methods. The issue occurs because the global wrapMetrics middleware records raw request paths and methods as Prometheus labels for metrics, creating unbounded time-series entries that exhaust memory.

Useful 0 Not Useful 0

Detection Guidance

Monitor Prometheus metrics for unbounded label cardinality growth, particularly for HTTP request paths and methods. Check for excessive unique time-series entries in metrics like http_request_duration_seconds or http_requests_total. Use commands like 'curl -s http://<timestamp-authority-address>:<port>/metrics | grep -E "http_request_duration_seconds|http_requests_total"' to inspect metric values.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause an out-of-memory (OOM) condition on the timestamp authority server, leading to denial-of-service. This impacts availability of the service, potentially disrupting timestamping operations for dependent systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service through memory exhaustion, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, prolonged downtime might affect compliance with availability requirements in these regulations. The root cause (unbounded metric labels) does not directly relate to data protection controls mandated by GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to timestamp-authority version 2.1.0 or later. If upgrading is not immediately possible, implement rate-limiting or block invalid requests at a reverse proxy level. Restrict Prometheus metric label cardinality by normalizing paths and methods to predefined allowlists.

Useful 0 Not Useful 0