Описание
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
A flaw was found in the @sigstore/core component. The preAuthEncoding function incorrectly uses Node.js 'ascii' encoding when converting Pre-Authentication Encoding (PAE) strings to bytes. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE).
Отчет
A flaw was found in @sigstore/core. The preAuthEncoding function uses Node.js ASCII encoding which truncates Unicode characters to their low byte, allowing payloadType to be mutated after signing without invalidating the DSSE signature.
Меры по смягчению последствий
Upgrade to @sigstore/core 3.2.1 or later.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sigstore | Fix deferred | ||
| Red Hat Enterprise Linux 8 | sigstore | Fix deferred | ||
| Red Hat Enterprise Linux 9 | sigstore | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | sigstore | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | sigstore | Fix deferred | ||
| Red Hat Satellite 6 | sigstore | Fix deferred | ||
| Self-service automation portal 2 | sigstore | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.
@sigstore/core has DSSE payloadType type-binding failure
5.4 Medium
CVSS3