openSUSE Security Advisory (SUSE-SU-2024:4042-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

govulncheck-vulndb-0.0.20241106T172143-1.1 on GA media (moderate)

govulncheck-vulndb-0.0.20241106T172143-1.1 on GA media Announcement ID: openSUSE-SU-2024:14470-1 Rating: moderate Cross-References: CVE-2024-10389 CVE-2024-48057 CVE-2024-51735 CVE-2024-51746 Affected Products: openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed...

CVE-2024-51746

A flaw was found in the Gitsign sigstore package. When Gitsign's credential cache is used, it may select the wrong Rekor entry to use during online verification when the log returns multiple entries. This may lead to the incorrect entry being used to pass verification successfully...

CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...