Description
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | sigstore-python | < 4.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-sigstore | 4.2.0-1.1 | openSUSE-SU-2026:10104-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | sigstore | < 4.2.0 | 4.2.0 | GHSA-hm8f-75xx-w2vr |
Advisories 1
- openSUSE-SU-2026:10104-1 python311-sigstore-4.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026