PT-2024-34879 · Gitsign+1 · Gitsign+1
Adityasaky
·
Published
2024-11-05
·
Updated
2024-11-22
·
CVE-2024-51746
CVSS v4.0
1.8
Low
| Vector | AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
gitsign (affected versions not specified)
Description
The issue arises when gitsign uses Rekor's search API to fetch entries for signature verification, using parameters such as the public key and the payload. However, the search API returns entries that match either condition rather than both. This can lead to gitsign selecting the wrong Rekor entry during online verification when multiple entries are returned by the log. The impact is minimal because, although gitsign does not match the payload against the entry, it ensures that the certificate matches. Exploitation would need to occur within the certificate validity window, which is 10 minutes, and would require action by the key holder.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Gitsign