CVE-2024-53267: sigstore-java has vulnerability with bundle verification

November 26, 2024 (updated December 9, 2024)

sigstore-java has insufficient verification for a situation where a validly-signed but “mismatched” bundle is presented as proof of inclusion into a transparency log

References

github.com/advisories/GHSA-q4xm-6fjc-5f6w
github.com/sigstore/sigstore-conformance/pull/166
github.com/sigstore/sigstore-java
github.com/sigstore/sigstore-java/pull/856
github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w
nvd.nist.gov/vuln/detail/CVE-2024-53267

Code Behaviors & Features

Detect and mitigate CVE-2024-53267 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →