CVE-2023-47122
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
- State
- Published
- Severity
- 4.2 Medium
- Published
- Nov 10, 2023
- Updated
- Sep 3, 2024
- Reserved
- Oct 30, 2023
Description
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N | GitHub_M |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
gitsignsigstore |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.