Affected by GO-2025-4193 and 1 other vulnerabilities

GO-2025-4193: Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio

GO-2026-4311: Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio

api

package

v0.1.1 Latest Latest Go to latest Published: Jul 26, 2021 License: Apache-2.0 Imports: 24 Imported by: 17

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/sigstore/fulcio

Documentation ¶

Index ¶

Variables
func FulcioCASigningCertHandler(subj *challenges.ChallengeResult, publicKey []byte) (string, []string, error)
func GoogleCASigningCertHandler(ctx context.Context, subj *challenges.ChallengeResult, publicKey []byte) (string, []string, error)
func SigningCertHandler(params operations.SigningCertParams, principal *oidc.IDToken) middleware.Responder
func Subject(ctx context.Context, tok *oidc.IDToken, cfg config.FulcioConfig, ...) (*challenges.ChallengeResult, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	MetricLatency = promauto.NewHistogramVec(prometheus.HistogramOpts{
		Name: "fulcio_api_latency",
		Help: "API Latency on calls",
	}, []string{"path", "code"})
)

Functions ¶

func FulcioCASigningCertHandler ¶

func FulcioCASigningCertHandler(subj *challenges.ChallengeResult, publicKey []byte) (string, []string, error)

func GoogleCASigningCertHandler ¶

func GoogleCASigningCertHandler(ctx context.Context, subj *challenges.ChallengeResult, publicKey []byte) (string, []string, error)

func SigningCertHandler ¶

func SigningCertHandler(params operations.SigningCertParams, principal *oidc.IDToken) middleware.Responder

func Subject ¶

func Subject(ctx context.Context, tok *oidc.IDToken, cfg config.FulcioConfig, publicKey, challenge []byte) (*challenges.ChallengeResult, error)

Types ¶

This section is empty.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL