CVE-2023-47122

Katalog CVE

CVSS 5.3 · Medium EPSS 0,37%

Kerentanan Improper Verification of Cryptographic Signature pada sigstore gitsign. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.

Rincian

Terbit di NVD

10 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc patch · advisory vendor
• https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236 patch
• https://github.com/sigstore/gitsign/pull/399 patch
• https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model product