TI-2023-25462 CVE-2023-47122 · GHSA-xvrc-2wvh-49vc
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Priority LOW 24
Gitsign is software for keyless Git signing using Sigstore.
sigstore
Records40All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9
Exploited now
sigstore records in CISA KEVNo sigstore vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
1 record in Gitsign · all components