github.com/sigstore/gitsign vulnerabilities (Go)

4 vulnerabilities.

• github.com/sigstore/gitsign Go gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2026-44309 Fix available 5.3 MediumMay 8, 2026
• github.com/sigstore/gitsign Go gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers CVE-2026-44310 Fix available 5.4 MediumMay 8, 2026
• github.com/sigstore/gitsign Go Use of incorrect Rekor entries during verification in gitsign CVE-2024-51746 Fix available 1.8 LowNovember 5, 2024
• github.com/sigstore/gitsign Go Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. CVE-2023-47122 Fix available 4.2 MediumNovember 10, 2023