github.com/sigstore/gitsign
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits | github.com/sigstore/gitsignRed Hat Trusted Artifact Signer/rhtas/gitsign-rhel9 | GoRed Hat | Medium | Fix reported | |
| gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers | github.com/sigstore/gitsignRed Hat Trusted Artifact Signer/rhtas/gitsign-rhel9 | GoRed Hat | Medium | Fix reported | |
| gitsign may use incorrect Rekor entries during verification | github.com/sigstore/gitsignRed Hat Trusted Artifact Signer/rhtas/gitsign-rhel9 | GoRed Hat | Low | Fix reported | |
| Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. | github.com/sigstore/gitsign | Go | Medium | Fix reported |