GHSA-8pmp-678w-c8xx

Source

https://github.com/advisories/GHSA-8pmp-678w-c8xx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8pmp-678w-c8xx

Aliases

CVE-2024-51746
GO-2024-3252

Published

2024-11-05T15:26:57Z

Modified

2024-11-06T19:55:44Z

Severity

1.8 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

gitsign may use incorrect Rekor entries during verification

Details

Summary

gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log.

Details

gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification.

PoC

Enable the credential cache and create commit signatures using the cached signing certificate. gitsign verify or git log --show-signature will demonstrate the use of the wrong entry index for the corresponding commit. Note that this depends on the order of matching entries in the response from the Rekor search API, so it may take a few attempts to trigger this.

Impact

Minimal. While gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder.

Database specific

{
    "nvd_published_at": "2024-11-05T19:15:08Z",
    "cwe_ids": [
        "CWE-287",
        "CWE-706"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-05T15:26:57Z"
}

References

Affected packages

Go / github.com/sigstore/gitsign

Package

Name: github.com/sigstore/gitsign; View open source insights on deps.dev
Purl: pkg:golang/github.com/sigstore/gitsign

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.0