Описание
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
A flaw was found in sigstore. The certificateOIDs option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.
Отчет
A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced. Any such call on sigstore <= 4.1.0 should be treated as if the certificateOIDs block was never there:
In order to be affected by the vulnerability, an application must use the sigstore.verify() function with certificateOIDs option.
Note: The CVSS has been adjusted with AC:H, due to it's low real-world exposure.
Меры по смягчению последствий
Upgrade to sigstore 4.1.1 or later. The majority of products have sigstore-js as a transitive dependency from the npm v10.9.7 package.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Not affected | ||
| Exploit Intelligence | sigstore | Affected | ||
| Red Hat Connectivity Link 1 | rhcl-1/rhcl-console-plugin-rhel9 | Not affected | ||
| Red Hat Connectivity Link 1 | sigstore | Affected | ||
| Red Hat Enterprise Linux 10 | nodejs22 | Not affected | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Not affected | ||
| Red Hat Enterprise Linux 10 | ubi10/nodejs-22 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | ubi10/nodejs-22-minimal | Fix deferred | ||
| Red Hat Enterprise Linux 10 | ubi10/nodejs-24 | Not affected | ||
| Red Hat Enterprise Linux 10 | ubi10/nodejs-24-minimal | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced
EPSS
5.9 Medium
CVSS3