Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/gitsign

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 1.8
    CVE-2024-51746

    Use of incorrect Rekor entries during verification in gitsign

    Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetc…

    sigstore gitsign github.com/sigstore/gitsign Go