Skip to content
OpenAdvisories

Package · Maven

dev.sigstore:sigstore-java

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.5
    CVE-2024-53267

    Vulnerability with bundle verification in sigstore-java

    sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This b…

    sigstore sigstore-java dev.sigstore:sigstore-java Maven