UBUNTU-CVE-2026-48791

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-48791
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48791.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-48791
Upstream
Published
2026-08-13T00:00:00Z
Modified
2026-08-13T19:30:19.954407153Z
Severity
  • 2.0 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with dev.sigstore:sigstore-java:2.0.0. Older versions are not affected; it is fixed in dev.sigstore:sigstore-java:2.1.0 A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

References

Affected packages

Ubuntu:24.04:LTS / golang-github-sigstore-sigstore

Package

Name
golang-github-sigstore-sigstore
Purl
pkg:deb/ubuntu/golang-github-sigstore-sigstore?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.0-3
1.7.5-1
1.8.0-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.8.0-2",
            "binary_name": "golang-github-sigstore-sigstore-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48791.json"

Ubuntu:26.04:LTS / golang-github-sigstore-sigstore

Package

Name
golang-github-sigstore-sigstore
Purl
pkg:deb/ubuntu/golang-github-sigstore-sigstore?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.9.3-2
1.9.5-1
1.10.1-1
1.10.3-1
1.10.4-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.10.4-1",
            "binary_name": "golang-github-sigstore-sigstore-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48791.json"