rekor-log-verifier (0.1.0) potentially affected by CVE-2026-24408 via sigstore (3.6.5)

sigstore PYPI version 3.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - rekor-log-verifier 0.1.0 Source cves: CVE-2026-24408 Source advisory: OSV:PYSEC-2026-1924...

rekor-log-verifier (0.1.0) potentially affected by CVE-2026-24408 via sigstore (3.6.5)

sigstore PYPI version 3.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - rekor-log-verifier 0.1.0 Source cves: CVE-2026-24408 Source advisory: OSV:GHSA-HM8F-75XX-W2VR...

CVE-2026-23831

Rekor (software supply chain transparency log) versions 1.4.3 and earlier are affected by a vulnerability where an empty spec.message can cause a nil pointer dereference during entry canonicalization, as validate() may return nil for empty message and Canonicalize() dereferences sign1Msg.Payload....

PT-2024-34879 · Gitsign +1 · Gitsign +1

Name of the Vulnerable Software and Affected Versions: gitsign affected versions not specified Description: The issue arises when gitsign uses Rekor's search API to fetch entries for signature verification, using parameters such as the public key and the payload. However, the search API returns...

CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...