PT-2026-24484 · Unknown · Sigstore-Ruby

Hanazuki · Publicado 2026-03-10 · Atualizado 2026-03-11 · CVE-2026-31830

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sigstore-ruby versions prior to 0.2.3

Description The software does not correctly handle verification failures when the artifact digest does not match the digest in the in-toto attestation subject. Specifically, the Sigstore::Verifier#verify function does not propagate the VerificationFailure returned by verify in toto. This results in successful verification even when the artifact does not match the attested subject, impacting the verification of DSSE bundles containing in-toto statements.

Recommendations Update to version 0.2.3 or later.

Exploit

Correção

Unchecked Return Value

Enumeração de Fraquezas

CWE-252

Identificadores relacionados

CVE-2026-31830

GHSA-MHG6-2Q2V-9H2C

Produtos afetados

Sigstore-Ruby

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31830.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sigstore/CVE-2026-31830.yml · Exploit
• https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c · Aviso do Fabricante
• https://github.com/sigstore/sigstore-ruby · Nota
• https://twitter.com/CVEnew/status/2031504065931133439 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mhg6-2q2v-9h2c · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31830 · Nota de Segurança
• https://t.me/CVEtracker/47036 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-31830 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1rqu37b/resumen_diario_de_vulnerabilidades_11032026 · Publicação no Reddit