PT-2023-30326 · Gitsign · Gitsign

Name of the Vulnerable Software and Affected Versions: gitsign versions 0.6.0 through 0.8.0 Description: The issue concerns how Rekor public keys are fetched in gitsign. Instead of using the local TUF client, versions of gitsign starting with 0.6.0 and prior to 0.8.0 fetch these keys via the Reko...