Skip to content
OpenAdvisories

Product · sigstore

sigstore-python

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.7
    CVE-2024-55655

    sigstore-python has insufficient validation of integration timestamp during verification

    sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verificati…

    sigstore sigstore-python sigstore PyPI