CVE-2024-53267

sigstore-java (the Java client) is affected by a vulnerability where KeylessVerifier.verify() may accept a validly-signed but mismatched bundle as proof of inclusion in a transparency log. The log-entry could be unrelated to the artifact, allowing a bundle to appear logged without proof the signi...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

dev.sigstore:sigstore-maven-plugin (1.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.2, <=2.0.4) +1 more potentially affected by CVE-2024-53267 via dev.sigstore:sigstore-java (1.0.0)

dev.sigstore:sigstore-java MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.sigstore:sigstore-java and may be impacted: - dev.sigstore:sigstore-maven-plugin 1.0.0 - org.apache.maven.resolver:maven-resolver-generator-sigstore...

sigstore-java has vulnerability with bundle verification

Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify The verifier may accept a bundle with an...

GHSA-Q4XM-6FJC-5F6W sigstore-java has vulnerability with bundle verification

Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify The verifier may accept a bundle with an...

PT-2024-35702 · Unknown · Sigstore-Java

Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to v1.1.0 Description: The issue is related to insufficient verification in sigstore-java for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log...

CVE-2024-53267: Improper Verification of Cryptographic Signature

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

sigstore-java security vulnerabilities

sigstore-java is a sigstore open source sigstore java client for interacting with sigstore infrastructure. A security vulnerability exists in sigstore-java that stems from sigstore-java's inability to adequately verify that validly signed but mismatched bundles are included in transparent logs...

sigstore-java:CertificatesFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=6009689561694208 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: CertificatesFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash...

sigstore-java:KeysFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=5464811684888576 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: KeysFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash Address:...

sigstore-java:BundleFactoryFuzzer: Security exception in com.google.gson.internal.bind.TypeAdapters$28.write

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=4746136236457984 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: BundleFactoryFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash...

sigstore-java:KeysFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=6513515213750272 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: KeysFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash Address:...