CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore.
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Affected
- sigstore/gitsign
- Source
- security-advisories@github.com
References
- https://docs.sigstore.dev/about/threat-model/#sigstore-threat-modelProduct
- https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236Patch
- https://github.com/sigstore/gitsign/pull/399Patch
- https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vcPatch, Vendor Advisory
- https://docs.sigstore.dev/about/threat-model/#sigstore-threat-modelProduct
- https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236Patch
- https://github.com/sigstore/gitsign/pull/399Patch
- https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vcPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.