CVE-2024-53267: Improper Verification of Cryptographic Signature

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

sigstore-java:CertificatesFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=6009689561694208 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: CertificatesFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash...

sigstore-java:KeysFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=5464811684888576 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: KeysFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash Address:...

sigstore-java:BundleFactoryFuzzer: Security exception in com.google.gson.internal.bind.TypeAdapters$28.write

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=4746136236457984 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: BundleFactoryFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash...

sigstore-java:KeysFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=6513515213750272 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: KeysFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash Address:...