Описание
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
A flaw was found in sigstore-js. The software derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a transparency log (tlog) entry can be inclusion-proof-only, meaning the inclusion proof path does not cryptographically bind the integratedTime. This allows an attacker who can supply an untrusted bundle to influence time-based verification decisions by choosing an arbitrary integratedTime. This could lead to incorrect validation of certificate validity.
Отчет
A flaw was found in sigstore-js. The tlog integratedTime field is not cryptographically bound in inclusionProof-only bundle v0.2 entries, allowing an attacker who supplies an untrusted bundle to influence time-based verification decisions.
Меры по смягчению последствий
Upgrade to the latest sigstore-js (>= 3.1.1) release that addresses GHSA-xgjw-pm74-86q4.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sigstore | Fix deferred | ||
| Red Hat Enterprise Linux 8 | sigstore | Fix deferred | ||
| Red Hat Enterprise Linux 9 | sigstore | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | sigstore | Fix deferred | ||
| Red Hat Satellite 6 | sigstore | Fix deferred | ||
| Self-service automation portal 2 | sigstore | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
sigstore-js has Insufficient Verification of Data Authenticity
EPSS
6.5 Medium
CVSS3