Vulnerability · Published Nov 10, 2023 · Assigned by GitHub_M
CVE-2023-47122Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Medium 4.2
In plain English
A medium-severity security flaw in gitsign from sigstore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/sigstore/gitsign | 0.8.0 | GHSA-xvrc-2wvh-49vc |
| Go | github.com/sigstore/gitsign | 0.8.0 | GO-2023-2332 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
References
- https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc x_refsource_CONFIRM
- https://github.com/sigstore/gitsign/pull/399 x_refsource_MISC
- https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236 x_refsource_MISC
- https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model x_refsource_MISC