PT-2023-30326 · Gitsign · Gitsign

Adityasaky · Published 2023-11-10 · Updated 2024-08-21 · CVE-2023-47122

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions gitsign versions 0.6.0 through 0.8.0

Description The issue concerns how Rekor public keys are fetched in gitsign. Instead of using the local TUF client, versions of gitsign starting with 0.6.0 and prior to 0.8.0 fetch these keys via the Rekor API. This could potentially allow gitsign clients to trust incorrect signatures if the upstream Rekor server is compromised. However, there is no known compromise of the default public good instance, rekor.sigstore.dev, which means users of this instance are unlikely to be affected.

Recommendations For gitsign versions 0.6.0 through 0.7.x, update to version 0.8.0 to resolve the issue. For version 0.8.0 and later, no action is required as the issue is already fixed in these versions. As a temporary workaround for versions prior to 0.8.0, consider restricting the use of the Rekor API for fetching public keys until the update to version 0.8.0 can be applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-47122

GHSA-XVRC-2WVH-49VC

GO-2023-2332

Affected Products

Gitsign

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47122.json · Exploit
• https://github.com/sigstore/gitsign/pull/399 · Patch
• https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc · Vendor Advisory
• https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-47122 · Security Note
• https://osv.dev/vulnerability/GO-2023-2332 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47122 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xvrc-2wvh-49vc · Vendor Advisory
• https://github.com/sigstore/gitsign · Note
• https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model · Note