Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14dnJjLTJ3dmgtNDl2Y84AA3Ht

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Impact

In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures.

There is no known compromise the default public good instance (rekor.sigstore.dev) - anyone using this instance is unlikely to be affected.

Patches

This was fixed in v0.8.0 via https://github.com/sigstore/gitsign/pull/399

Workarounds

n/a

References

Are there any links users can visit to find out more?

https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model

Permalink: https://github.com/advisories/GHSA-xvrc-2wvh-49vc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14dnJjLTJ3dmgtNDl2Y84AA3Ht
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 4.2
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Identifiers: GHSA-xvrc-2wvh-49vc, CVE-2023-47122
References:

• https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc
• https://nvd.nist.gov/vuln/detail/CVE-2023-47122
• https://github.com/sigstore/gitsign/pull/399
• https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236
• https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model
• https://github.com/advisories/GHSA-xvrc-2wvh-49vc

Repository: https://github.com/sigstore/gitsign
Blast Radius: 2.0

Affected Packages