PyPI: sigstore
CVE-2024-55655
Safety vulnerability ID: SFTY-20241210-47842
Safety legacy ID: pyup.io-76385
Versions of sigstore-python newer than 2.0.0 but before 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise.
Overview
sigstore has insufficient validation of integration timestamp during verification
Advisory
Versions of sigstore-python newer than 2.0.0 but before 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20241210-47842/CVE-2024-55655
- https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7
- https://nvd.nist.gov/vuln/detail/CVE-2024-55655
- https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf
- https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0
- https://github.com/advisories/GHSA-hhfg-fwrw-87w7
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more