github.com/sigstore/sigstore-go
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| sigstore-go fails to check signature timestamps against a signing key's validity period | github.com/sigstore/sigstore-go | Go | Low | Fix reported | |
| sigstore-go has a multi-log threshold bypass via single compromised log | github.com/sigstore/sigstore-goOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel8 | GoRed Hat | Medium | Fix reported | |
| sigstore-go has an unbounded loop over untrusted input can lead to endless data attack | github.com/sigstore/sigstore-go | Go | Low | Fix reported |