GitHub Advisoryadvisory · Go
GHSA-xvrc-2wvh-49vc Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
MEDIUM
Official page ↗
- Aliases
- CVE-2023-47122
- Ecosystem
- Go
- Packages
- github.com/sigstore/gitsign
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-347
- Reviewed
- 2023-11-14
Affected packages
• Go github.com/sigstore/gitsign: >= 0.6.0, < 0.8.0 → fixed in 0.8.0
Description
Impact
In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures.
There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unlikely to be affected.
Patches
This was fixed in v0.8.0 via https://github.com/sigstore/gitsign/pull/399
Workarounds
n/a
References
_Are there any links users can visit to find out more?_
https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model
Related
Alias · CVE (1)
- CVE-2023-47122 Gitsign is software for keyless Git signing using Sigstore. vulnerability
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc web
- https://nvd.nist.gov/vuln/detail/CVE-2023-47122 advisory
- https://github.com/sigstore/gitsign/pull/399 web
- https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236 web
- https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model web
- https://github.com/sigstore/gitsign package