PT-2024-36570 · Unknown · Sigstore-Python

Haydentherapper · Published 2024-12-10 · Updated 2024-12-11 · CVE-2024-55655

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions sigstore-python versions 2.0.0 through 3.6.0

Description The issue concerns insufficient validation of the "integration time" in "v2" and "v3" bundles during the verification flow. This affects versions of sigstore-python newer than 2.0.0 but prior to 3.6.0. The "integration time" is verified if a source of signed time, such as an inclusion promise, is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as they always require an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness are low, as Sigstore contains multiple other enforcing components that prevent an attacker from impersonating a valid signature by modifying the integration timestamp. An attacker who modifies the integration timestamp can induce a Denial of Service, but this is already possible with bundle access. An attacker could upload a new entry to the transparency service and substitute their new entry's time, but this would be rejected at validation time due to the new entry's signed time being outside the validity window of the original signing certificate.

Recommendations For versions 2.0.0 through 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the verification flow to minimize the risk of exploitation. Avoid modifying the integration timestamp within bundles, as this could induce a Denial of Service. Restrict access to the transparency service to prevent attackers from uploading new entries with substituted times.

Exploit

Fix

RCE

Weakness Enumeration

CWE-325

CWE-20

Related Identifiers

CVE-2024-55655

GHSA-HHFG-FWRW-87W7

Affected Products

Sigstore-Python

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55655.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-55655 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhfg-fwrw-87w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55655 · Security Note
• https://github.com/sigstore/sigstore-python · Note
• https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0 · Note
• https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf · Note
• https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7 · Note
• https://t.me/cvedetector/12613 · Telegram Post
• https://twitter.com/CVEnew/status/1866809440608936025 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1866630422899146832 · Twitter Post