Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/gitsign

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.3
    CVE-2026-44309

    gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instea…

    sigstore gitsign github.com/sigstore/gitsign gitsign Debian Ubuntu Go
  • Medium 5.4
    CVE-2026-44310

    gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the s…

    sigstore gitsign github.com/sigstore/gitsign gitsign Debian Ubuntu Go
  • Low 1.8
    CVE-2024-51746

    Use of incorrect Rekor entries during verification in gitsign

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetc…

    sigstore gitsign github.com/sigstore/gitsign Go
  • Medium 4.2
    CVE-2023-47122

    Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

    Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be c…

    sigstore gitsign github.com/sigstore/gitsign Go