dev.sigstore:sigstore-maven-plugin (>=0.4.0 <=1.1.0), hboutemy:sigstore-maven-plugin (=1.0.0-beta-3) +3 more potentially affected by CVE-2024-54140 via dev.sigstore:sigstore-java (>=0.4.0 <=1.1.0)

dev.sigstore:sigstore-java MAVEN version =0.4.0, =0.4.0, =2.0.2, =2.0.3, =2.0.4 Source cves: CVE-2024-54140 Source advisory: OSV:GHSA-JP26-88MW-89QR...

CVE-2024-54140

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify. Currently...

CVE-2024-54140

creationtimestamp| type| source ---|---|--- 2024-12-05 22:11:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113602505841454122 2024-12-05 23:43:40+00:00| seen| https://t.me/cvedetector/12143...

CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify. Currently...

CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify. Currently...

CVE-2024-54140 sigstore-java has a vulnerability with bundle verification

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify. Currently...