Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-vtc5-gt7p-4bcd |
|---|
| Summary | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0. |
|---|
| Aliases |
| 0 |
|
| 1 |
| alias |
GHSA-7rmh-48mx-2vwc |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
295 |
| name |
Improper Certificate Validation |
| description |
The product does not validate, or incorrectly validates, a certificate. |
|
| 1 |
| cwe_id |
347 |
| name |
Improper Verification of Cryptographic Signature |
| description |
The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 4.0 - 6.9 |
|---|
| Exploitability | 0.5 |
|---|
| Weighted_severity | 6.2 |
|---|
| Risk_score | 3.1 |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-vtc5-gt7p-4bcd |
|---|