Skip to content
OpenAdvisories

Package · PyPI

sigstore

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • None 0.0
    CVE-2026-24408

    sigstore has CSRF possibility in OIDC authentication during signing

    sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a p…

    sigstore sigstore-python sigstore PyPI
  • Low 2.7
    CVE-2024-55655

    sigstore-python has insufficient validation of integration timestamp during verification

    sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verificati…

    sigstore sigstore-python sigstore PyPI