CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

What is CVE-2024-51746?

CVE-2024-51746 is a low-severity vulnerability in sigstore gitsign, published on 5 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder.

Weakness: CWE-706

Which versions are affected by CVE-2024-51746?

3 open source packages ship an affected version, including github.com/sigstore/gitsign.

How do I fix CVE-2024-51746?

Upgrade github.com/sigstore/gitsign to 0.11.0 or later.

Is CVE-2024-51746 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-51746 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8pmp-678w-c8xx, GO-2024-3252.