sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sigstore-go | Sigstore | * | 1.2.0 (excluding) |
| Red Hat Hardened Images | RedHat | spire1-15-main-1.15.2-0.3.hum1 | * |
| Red Hat Hardened Images | RedHat | spire1-14-main-1.14.7-0.3.hum1 | * |
| Red Hat Hardened Images | RedHat | trivy-main-0.72.0-0.1.3.hum1 | * |
| Sigstore-go | Ubuntu | upstream | * |