x/vulndb: potential Go vuln in github.com/sigstore/gitsign: GHSA-8pmp-678w-c8xx

[GoVulnBot]

Advisory GHSA-8pmp-678w-c8xx references a vulnerability in the following Go modules:

Module
github.com/sigstore/gitsign

Description:

Summary

gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log.

Details

gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additiona...

References:

• ADVISORY: https://github.com/advisories/GHSA-8pmp-678w-c8xx
• ADVISORY: https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx

Cross references:

• github.com/sigstore/gitsign appears in 1 other report(s):
  • data/reports/GO-2023-2332.yaml (https://github.com/golang/vulndb/issues/2332)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/sigstore/gitsign
      versions:
        - fixed: 0.11.0
      vulnerable_at: 0.10.2
summary: gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
ghsas:
    - GHSA-8pmp-678w-c8xx
references:
    - advisory: https://github.com/advisories/GHSA-8pmp-678w-c8xx
    - advisory: https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx
source:
    id: GHSA-8pmp-678w-c8xx
    created: 2024-11-05T16:01:27.572019431Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/625955 mentions this issue: data/reports: add 4 unreviewed reports