CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

gitsign may use incorrect Rekor entries during verification

Summary gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. Details gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payloa...

GHSA-8PMP-678W-C8XX gitsign may use incorrect Rekor entries during verification

Summary gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. Details gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payloa...

Gitsign 安全漏洞

Gitsign is a tool from the individual developers of Gitsign that enables key-free completion of signing Git commits. A security vulnerability exists in Gitsign that stems from the fact that there is no additional validation to ensure that the hash of an entry matches the payload being validated...

PT-2024-34879 · Gitsign +1 · Gitsign +1

Name of the Vulnerable Software and Affected Versions: gitsign affected versions not specified Description: The issue arises when gitsign uses Rekor's search API to fetch entries for signature verification, using parameters such as the public key and the payload. However, the search API returns...

GO-2023-2332 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: temporal, tekton-chains, sigstore-scaffolding, skopeo, sops, weaviate, oauth2-proxy, wolfictl, melange, timestamp-authority, dex, vexctl, apko, goreleaser, falcoctl, tkn, rekor, slsa-verifier, kargo, step-ca, aactl, flux-kustomize-controller, kube-rbac-proxy,...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: cri-tools, gitsign, argo-workflows, crane, k8sgpt, guac, flux-helm-controller, bom, dagger, docker-credential-gcr, argo-workflows-fips, helm-operator-fips, zot, goreleaser, k9s, kargo, helm-fips, policy-controller-fips, buildkitd, cadvisor, chartmuseum, kubeflow-kati...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: cri-tools, gitsign, argo-workflows, crane, k8sgpt, guac, flux-helm-controller, bom, dagger, docker-credential-gcr, argo-workflows-fips, helm-operator-fips, zot, goreleaser, k9s, kargo, helm-fips, policy-controller-fips, buildkitd, cadvisor, chartmuseum, kubeflow-kati...

CVE-2023-49569 vulnerabilities

Vulnerabilities for packages: gitsign, pulumi-kubernetes-operator, gitness, nuclei, scorecard, goreleaser, src-fingerprint, bom, go-licenses...

CVE-2023-49569 vulnerabilities

Vulnerabilities for packages: goreleaser, gitsign, gitness, scorecard, bom, go-licenses, nuclei, src-fingerprint, pulumi-kubernetes-operator...

GHSA-449P-3H89-PW88 vulnerabilities

Vulnerabilities for packages: gitsign, pulumi-kubernetes-operator, gitness, nuclei, scorecard, goreleaser, src-fingerprint, bom, go-licenses...

GHSA-449P-3H89-PW88 vulnerabilities

Vulnerabilities for packages: goreleaser, gitsign, gitness, scorecard, bom, go-licenses, nuclei, src-fingerprint, pulumi-kubernetes-operator...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, gitsign, tekton-chains, kubescape, minio, boring-registry, mc, vexctl...

GHSA-7F9X-GW85-8GRF vulnerabilities

Vulnerabilities for packages: falcoctl, gitsign, tekton-chains, kubescape, vexctl...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl-fips, vexctl, tekton-chains, kubescape, cosign-fips, falcoctl...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: falcoctl, gitsign, tekton-chains, kubescape, vexctl...

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Impact In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise...

GHSA-XVRC-2WVH-49VC Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Impact In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise...

SUSE CVE-2023-47122

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...