CVE-2024-53267

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-53267", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-11-19T20:08:14.481Z", "datePublished": "2024-11-26T18:41:29.240Z", "dateUpdated": "2024-11-26T19:46:41.263Z"}, "containers": {"cna": {"title": "Vulnerability with bundle verification in sigstore-java", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w"}, {"name": "https://github.com/sigstore/sigstore-conformance/pull/166", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-conformance/pull/166"}, {"name": "https://github.com/sigstore/sigstore-java/pull/856", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-java/pull/856"}], "affected": [{"vendor": "sigstore", "product": "sigstore-java", "versions": [{"version": ">= 1.0.0, < 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-26T18:41:29.240Z"}, "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but \"mismatched\" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.verify(). The verifier may accept a bundle with an unrelated log entry, cryptographically verifying everything but fails to ensure the log entry applies to the artifact in question, thereby \"verifying\" a bundle without any proof the signing event was logged. This allows the creation of a bundle without fulcio certificate and private key combined with an unrelated but time-correct log entry to fake logging of a signing event. A malicious actor using a compromised identity may want to do this to prevent discovery via rekor's log monitors. The signer's identity will still be available to the verifier. The signature on the bundle must still be on the correct artifact for the verifier to pass. sigstore-gradle-plugin and sigstore-maven-plugin are not affected by this as they only provide signing functionality. This issue has been patched in v1.1.0 release with PR #856. All users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-q4xm-6fjc-5f6w", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "sigstore", "product": "sigstore-java", "cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.0.0", "status": "affected", "lessThan": "1.1.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-26T19:21:47.363473Z", "id": "CVE-2024-53267", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T19:46:41.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-53267", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-26T19:21:47.363473Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "vendor": "sigstore", "product": "sigstore-java", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T19:44:41.319Z"}}], "cna": {"title": "Vulnerability with bundle verification in sigstore-java", "source": {"advisory": "GHSA-q4xm-6fjc-5f6w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-java", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.1.0"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w", "name": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-conformance/pull/166", "name": "https://github.com/sigstore/sigstore-conformance/pull/166", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-java/pull/856", "name": "https://github.com/sigstore/sigstore-java/pull/856", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but \"mismatched\" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.verify(). The verifier may accept a bundle with an unrelated log entry, cryptographically verifying everything but fails to ensure the log entry applies to the artifact in question, thereby \"verifying\" a bundle without any proof the signing event was logged. This allows the creation of a bundle without fulcio certificate and private key combined with an unrelated but time-correct log entry to fake logging of a signing event. A malicious actor using a compromised identity may want to do this to prevent discovery via rekor's log monitors. The signer's identity will still be available to the verifier. The signature on the bundle must still be on the correct artifact for the verifier to pass. sigstore-gradle-plugin and sigstore-maven-plugin are not affected by this as they only provide signing functionality. This issue has been patched in v1.1.0 release with PR #856. All users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-11-26T18:41:29.240Z"}}}, "cveMetadata": {"cveId": "CVE-2024-53267", "state": "PUBLISHED", "dateUpdated": "2024-11-26T19:46:41.263Z", "dateReserved": "2024-11-19T20:08:14.481Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-11-26T18:41:29.240Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sigstore-java", "vendor": "sigstore", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.1.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:sigstore:sigstore-java:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "sigstore-java", "vendor": "sigstore", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but \"mismatched\" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.verify(). The verifier may accept a bundle with an unrelated log entry, cryptographically verifying everything but fails to ensure the log entry applies to the artifact in question, thereby \"verifying\" a bundle without any proof the signing event was logged. This allows the creation of a bundle without fulcio certificate and private key combined with an unrelated but time-correct log entry to fake logging of a signing event. A malicious actor using a compromised identity may want to do this to prevent discovery via rekor's log monitors. The signer's identity will still be available to the verifier. The signature on the bundle must still be on the correct artifact for the verifier to pass. sigstore-gradle-plugin and sigstore-maven-plugin are not affected by this as they only provide signing functionality. This issue has been patched in v1.1.0 release with PR #856. All users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "sigstore-java es un cliente java de sigstore para interactuar con la infraestructura de sigstore. sigstore-java no tiene suficiente verificaci\u00f3n para una situaci\u00f3n en la que un paquete firmado v\u00e1lidamente pero \"no coincidente\" se presenta como prueba de inclusi\u00f3n en un registro de transparencia. Este error afecta a los clientes que usan cualquier variaci\u00f3n de KeylessVerifier.verify(). El verificador puede aceptar un paquete con una entrada de registro no relacionada, verificando criptogr\u00e1ficamente todo, pero no puede garantizar que la entrada de registro se aplique al artefacto en cuesti\u00f3n, por lo que \"verifica\" un paquete sin ninguna prueba de que se haya registrado el evento de firma. Esto permite la creaci\u00f3n de un paquete sin certificado fulcio y clave privada combinados con una entrada de registro no relacionada pero correcta en el tiempo para simular el registro de un evento de firma. Un actor malintencionado que use una identidad comprometida puede querer hacer esto para evitar el descubrimiento a trav\u00e9s de los monitores de registro de rekor. La identidad del firmante seguir\u00e1 estando disponible para el verificador. La firma en el paquete debe seguir estando en el artefacto correcto para que el verificador la apruebe. Sigstore-gradle-plugin y sigstore-maven-plugin no se ven afectados por esto, ya que solo brindan funcionalidad de firma. Este problema se ha corregido en la versi\u00f3n v1.1.0 con PR #856. Se recomienda a todos los usuarios que actualicen. No existen workarounds conocidas para esta vulnerabilidad."}], "id": "CVE-2024-53267", "lastModified": "2026-06-17T08:08:43.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-53267", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-26T19:21:47.363473Z", "version": "2.0.3"}}]}, "published": "2024-11-26T19:15:30.473", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-conformance/pull/166"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-java/pull/856"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}