GHSA-xvrc-2wvh-49vc

Source

https://github.com/advisories/GHSA-xvrc-2wvh-49vc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-xvrc-2wvh-49vc/GHSA-xvrc-2wvh-49vc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xvrc-2wvh-49vc

Aliases

Related

CVE-2023-47122

Published

2023-11-14T20:31:23Z

Modified

2024-08-21T14:56:43.303844Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Details

Impact

In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures.

There is no known compromise the default public good instance (rekor.sigstore.dev) - anyone using this instance is unlikely to be affected.

Patches

This was fixed in v0.8.0 via https://github.com/sigstore/gitsign/pull/399

Workarounds

n/a

References

Are there any links users can visit to find out more?

https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model

Database specific

{
    "nvd_published_at": "2023-11-10T22:15:14Z",
    "cwe_ids": [
        "CWE-347"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-14T20:31:23Z"
}

References

Affected packages

Go / github.com/sigstore/gitsign

Package

Name: github.com/sigstore/gitsign; View open source insights on deps.dev
Purl: pkg:golang/github.com/sigstore/gitsign

Affected ranges

Type: SEMVER
Events: Introduced

0.6.0

Fixed

0.8.0