sigstore-python up to 3.5.x Integration Time missing cryptographic step

Summaryinfo

A vulnerability marked as problematic has been reported in sigstore-python up to 3.5.x. This affects an unknown function of the component Integration Time. The manipulation leads to missing cryptographic step. This vulnerability is traded as CVE-2024-55655. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in sigstore-python up to 3.5.x. This issue affects an unknown code of the component Integration Time. The manipulation with an unknown input leads to a missing cryptographic step vulnerability. Using CWE to declare the problem leads to CWE-325. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. Impacted is integrity. The summary by CVE is:

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-55655 since 12/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 3.6.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 300b502ae99ebfaace124f1f4e422a6a669369cf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Name

• sigstore-python

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion