Lucene search
PRIOn knowledge basePRION:CVE-2023-47122HistoryNov 10, 2023 - 10:15 p.m.
Design/Logic Flaw
2023-11-1022:15:00
PRIOn knowledge base
www.prio-n.com
2
gitsign
git signing
sigstore
rekor api
tuf client
compromised server
incorrect signatures
public good instance
vulnerability
nvd
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (rekor.sigstore.dev) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
Related
osv
osv
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
2023-11-14 20:31:23
CVE-2023-47122
2023-11-10 22:15:14
cvelist
cvelist
cve
cve
CVE-2023-47122
2023-11-10 22:15:14
veracode
veracode
Improper Verification Of Cryptographic Signature
2023-11-13 07:25:51
nvd
nvd
CVE-2023-47122
2023-11-10 22:15:14
github
github