x/vulndb: potential Go vuln in github.com/sigstore/gitsign: CVE-2024-51746

[GoVulnBot]

Advisory CVE-2024-51746 references a vulnerability in the following Go modules:

Module
github.com/sigstore/gitsign

Description:
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign ...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-51746
• WEB: GHSA-8pmp-678w-c8xx

Cross references:

• github.com/sigstore/gitsign appears in 1 other report(s):
  • data/reports/GO-2023-2332.yaml (x/vulndb: potential Go vuln in github.com/sigstore/gitsign: CVE-2023-47122 #2332)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/sigstore/gitsign
      vulnerable_at: 0.11.0
summary: CVE-2024-51746 in github.com/sigstore/gitsign
cves:
    - CVE-2024-51746
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-51746
    - web: https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx
source:
    id: CVE-2024-51746
    created: 2024-11-05T20:01:23.227385535Z
review_status: UNREVIEWED

[tatianab]

Duplicate of #3252