112 matches found
CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...
CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...
CVE-2024-51746
CVE-2024-51746 affects gitsign. The vulnerability arises when Rekor’s search API is used to verify a signature: the API may return entries that match either the public key or the payload, not both. As a result, gitsign could select an incorrect Rekor entry during online verification, and, because...
CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...
GHSA-8PMP-678W-C8XX gitsign may use incorrect Rekor entries during verification
Summary gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. Details gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payloa...
gitsign may use incorrect Rekor entries during verification
Summary gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. Details gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payloa...
PT-2024-34879 · Gitsign +1 · Gitsign +1
Name of the Vulnerable Software and Affected Versions: gitsign affected versions not specified Description: The issue arises when gitsign uses Rekor's search API to fetch entries for signature verification, using parameters such as the public key and the payload. However, the search API returns...
Gitsign 安全漏洞
Gitsign is a tool from the individual developers of Gitsign that enables key-free completion of signing Git commits. A security vulnerability exists in Gitsign that stems from the fact that there is no additional validation to ensure that the hash of an entry matches the payload being validated...
GO-2023-2332 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: cloudflared, rabbitmq-messaging-topology-operator, falcoctl, temporal-ui-server, goreleaser, cosign, caddy, vexctl, oauth2-proxy, guac, argo-workflows, rekor, sops, weaviate, dgraph, rook, fulcio, temporal, policy-controller, zot, frp, melange, skaffold, step,...
GHSA-XW73-RW38-6VJC vulnerabilities
Vulnerabilities for packages: docker-credential-gcr, buildkitd, argo-workflows-fips, cadvisor-fips, aactl, argo-workflows, helm-operator, vexctl, kubevela, zot, crane, docker-machine-driver-harvester, falcoctl, newrelic-infrastructure-agent, tekton-chains, k3s, kots, cosign, flux,...
CVE-2024-24557 vulnerabilities
Vulnerabilities for packages: docker-credential-gcr, buildkitd, argo-workflows-fips, cadvisor-fips, aactl, argo-workflows, helm-operator, vexctl, kubevela, zot, crane, docker-machine-driver-harvester, falcoctl, newrelic-infrastructure-agent, tekton-chains, k3s, kots, cosign, flux,...
CVE-2023-49569 vulnerabilities
Vulnerabilities for packages: gitness, scorecard, go-licenses, src-fingerprint, nuclei, bom, goreleaser, pulumi-kubernetes-operator, gitsign...
CVE-2023-49569 vulnerabilities
Vulnerabilities for packages: gitness, goreleaser, scorecard, gitsign, src-fingerprint, go-licenses, nuclei, bom, pulumi-kubernetes-operator...
GHSA-449P-3H89-PW88 vulnerabilities
Vulnerabilities for packages: gitness, scorecard, go-licenses, src-fingerprint, nuclei, bom, goreleaser, pulumi-kubernetes-operator, gitsign...
GHSA-449P-3H89-PW88 vulnerabilities
Vulnerabilities for packages: gitness, goreleaser, scorecard, gitsign, src-fingerprint, go-licenses, nuclei, bom, pulumi-kubernetes-operator...
CVE-2024-21664 vulnerabilities
Vulnerabilities for packages: mc, falcoctl, boring-registry, gitsign, spire-server, vexctl, kubescape, tekton-chains, minio...
GHSA-7F9X-GW85-8GRF vulnerabilities
Vulnerabilities for packages: falcoctl, kubescape, gitsign, vexctl, tekton-chains...