Search for packages
| purl | pkg:pypi/sigstore@2.1.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-9281-a23g-t3af
Aliases: CVE-2026-24408 GHSA-hm8f-75xx-w2vr |
sigstore CSRF possibility in OIDC authentication during signing The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. |
Affected by 0 other vulnerabilities. |
|
VCID-em8d-uu42-h7dx
Aliases: CVE-2024-55655 GHSA-hhfg-fwrw-87w7 |
sigstore has insufficient validation of integration timestamp during verification Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T06:44:49.279484+00:00 | GitLab Importer | Affected by | VCID-9281-a23g-t3af | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/sigstore/CVE-2026-24408.yml | 38.6.0 |
| 2026-06-06T05:34:26.754553+00:00 | GitLab Importer | Affected by | VCID-em8d-uu42-h7dx | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/sigstore/CVE-2024-55655.yml | 38.6.0 |