Количество 3
Количество 3
CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore. In version ...
GHSA-xvrc-2wvh-49vc
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2023-47122 Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available. | CVSS3: 4.2 | 0% Низкий | больше 2 лет назад |
| CVE-2023-47122 Gitsign is software for keyless Git signing using Sigstore. In version ... | CVSS3: 4.2 | 0% Низкий | больше 2 лет назад |
| GHSA-xvrc-2wvh-49vc Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. | CVSS3: 4.2 | 0% Низкий | больше 2 лет назад |
Уязвимостей на страницу