GHSA-Q4XM-6FJC-5F6W sigstore-java has vulnerability with bundle verification

Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify The verifier may accept a bundle with an...

dev.sigstore:sigstore-maven-plugin (=1.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.2 <=2.0.4) +1 more potentially affected by CVE-2024-53267 via dev.sigstore:sigstore-java (=1.0.0)

dev.sigstore:sigstore-java MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.sigstore:sigstore-java and may be impacted: - dev.sigstore:sigstore-maven-plugin =1.0.0 - org.apache.maven.resolver:maven-resolver-generator-sigstore...

sigstore-java 安全漏洞

sigstore-java is a sigstore open source sigstore java client for interacting with sigstore infrastructure. A security vulnerability exists in sigstore-java that stems from sigstore-java's inability to adequately verify that validly signed but mismatched bundles are included in transparent logs...

PT-2024-35702 · Unknown · Sigstore-Java

Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to v1.1.0 Description: The issue is related to insufficient verification in sigstore-java for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log...