sigstore gitsign up to 0.10.x name resolution

Summaryinfo

A vulnerability identified as problematic has been detected in sigstore gitsign up to 0.10.x. This issue affects some unknown processing. This manipulation causes name resolution. This vulnerability appears as CVE-2024-51746. The attack requires local access. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in sigstore gitsign up to 0.10.x and classified as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a name resolution vulnerability. The CWE definition for the vulnerability is CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. As an impact it is known to affect integrity. The summary by CVE is:

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-51746 since 10/31/2024. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 212587 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:4042-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (212587). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• sigstore

Name

• gitsign

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10

Website

• Product: https://github.com/sigstore/gitsign/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion