Skip to content
OpenAdvisories

Package · Debian

gitsign

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2026-44309

    gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instea…

    sigstore gitsign github.com/sigstore/gitsign gitsign Debian Ubuntu Go
  • Medium 5.4
    CVE-2026-44310

    gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the s…

    sigstore gitsign github.com/sigstore/gitsign gitsign Debian Ubuntu Go