PT-2026-37206 · Go · Github.Com/Supply-Chain-Tools/Gitverify

Publicado 2026-04-24 · Atualizado 2026-04-24

OSV

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

gitverify is still a prototype.

Impact

The bug is related to requireSignedTags which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor.

Patches

Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet).

Workarounds

No

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

GHSA-H829-5CG7-6HFF

Produtos afetados

Github.Com/Supply-Chain-Tools/Gitverify

Referências · 4

• https://github.com/supply-chain-tools/gitverify · Nota
• https://github.com/supply-chain-tools/gitverify/commit/c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 · Nota
• https://github.com/supply-chain-tools/gitverify/security/advisories/GHSA-h829-5cg7-6hff · Nota
• https://osv.dev/vulnerability/GHSA-h829-5cg7-6hff · Aviso do Fabricante