Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

go

github.com/sigstore/gitsign

go

View on github.com · View on proxy.golang.org

Security Advisories for github.com/sigstore/gitsign in go

Moderate
3 months ago

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits GSA_kwCzR0hTQS03cm1oLTQ4bXgtMnZ3Y84ABWgZ

go github.com/sigstore/gitsign
Moderate
3 months ago

gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers GSA_kwCzR0hTQS03YzM3LWd4NnctOHZjNc4ABWfX

go github.com/sigstore/gitsign
Low
almost 2 years ago

gitsign may use incorrect Rekor entries during verification GSA_kwCzR0hTQS04cG1wLTY3OHctYzh4eM4ABA-V

go github.com/sigstore/gitsign
Moderate
almost 3 years ago

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. GSA_kwCzR0hTQS14dnJjLTJ3dmgtNDl2Y84AA3Ht

go github.com/sigstore/gitsign

Filter by Severity

Moderate 3 Low 1