github - ghsa-hhfg-fwrw-87w7

GHSA-HHFG-FWRW-87W7

Vulnerability from github – Published: 2024-12-11 18:42 – Updated: 2024-12-11 18:42

Summary

sigstore has insufficient validation of integration timestamp during verification

Details

Summary

Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present.

This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise.

Details

Sigstore uses signed time to support verification of signatures made against short-lived signing keys.

Impact

The impact and severity of this weakness is low, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify).

Separately, an attacker could upload a new entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.

Severity ?

2.7 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sigstore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "3.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-55655"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-325"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-11T18:42:00Z",
    "nvd_published_at": "2024-12-10T23:15:06Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nVersions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the \"integration time\" present in \"v2\" and \"v3\" bundles during the verification flow: the \"integration time\" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present.\n\nThis does not affect \"v1\" bundles, as the \"v1\" bundle format always requires an inclusion promise.\n\n### Details\n\nSigstore uses signed time to support verification of signatures made against short-lived signing keys. \n\n### Impact\n\nThe impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify).\n\nSeparately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry\u0027s time. However, this would still be rejected at validation time, as the new entry\u0027s (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.\n",
  "id": "GHSA-hhfg-fwrw-87w7",
  "modified": "2024-12-11T18:42:00Z",
  "published": "2024-12-11T18:42:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55655"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sigstore/sigstore-python"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "sigstore has insufficient validation of integration timestamp during verification"
}

CVE-2024-55655 (GCVE-0-2024-55655)

Vulnerability from cvelistv5 – Published: 2024-12-10 23:06 – Updated: 2024-12-11 16:03

Summary

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.

Severity ?

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

CWE

CWE-20 - Improper Input Validation
CWE-325 - Missing Cryptographic Step

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/sigstore-python/secur…	x_refsource_CONFIRM
	https://github.com/sigstore/sigstore-python/commi…	x_refsource_MISC
	https://github.com/sigstore/sigstore-python/relea…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	sigstore-python	Affected: >= 2.0.0, < 3.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-55655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T16:03:32.260056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T16:03:42.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sigstore-python",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 3.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the \"integration time\" present in \"v2\" and \"v3\" bundles during the verification flow: the \"integration time\" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect \"v1\" bundles, as the \"v1\" bundle format always requires an inclusion promise.\n\nSigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry\u0027s time. However, this would still be rejected at validation time, as the new entry\u0027s (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-325",
              "description": "CWE-325: Missing Cryptographic Step",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-10T23:06:42.193Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7"
        },
        {
          "name": "https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf"
        },
        {
          "name": "https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hhfg-fwrw-87w7",
        "discovery": "UNKNOWN"
      },
      "title": "sigstore-python has insufficient validation of integration timestamp during verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-55655",
    "datePublished": "2024-12-10T23:06:42.193Z",
    "dateReserved": "2024-12-10T14:48:24.296Z",
    "dateUpdated": "2024-12-11T16:03:42.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-HHFG-FWRW-87W7

Summary

Details

Impact

CVE-2024-55655 (GCVE-0-2024-55655)

Tags

Sightings

Nomenclature