CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Attackers could trick gitsign users into trusting invalid signatures by compromising the upstream Rekor API, bypassing local TUF verification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-47122?
CVE-2023-47122 is a medium-severity vulnerability in sigstore gitsign, published on 10 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
Weakness: CWE-347
Which versions are affected by CVE-2023-47122?
3 open source packages ship an affected version, including github.com/sigstore/gitsign. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/gitsign Go | From 0.6.0 | 0.8.0 |
github.com/sigstore/gitsign Go | From 0.6.0 | 0.8.0 |
github.com/sigstore/gitsign Go | From 0.6.0 | 0.8.0 |
Products include Sigstore Gitsign.
How do I fix CVE-2023-47122?
Upgrade github.com/sigstore/gitsign to 0.8.0 or later.
Is CVE-2023-47122 being exploited?
There is no known exploitation of CVE-2023-47122 in the wild and no public exploit code.
Sources
Also known as GHSA-xvrc-2wvh-49vc, GO-2023-2332.