Go/github.com/sigstore/gitsign CVE-2024-51746: low 1.8, EPSS 0.12%

gitsign may use incorrect Rekor entries during verification

Action: Upgrade github.com/sigstore/gitsign to 0.11.0 or later.

go get github.com/sigstore/gitsign@v0.11.0

Affected

Fixed versions

Sources

• osv: GHSA-8pmp-678w-c8xx
• nvd: CVE-2024-51746
• https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx
• https://github.com/sigstore/gitsign

CVE-2024-51746 · published 2024-11-05T15:26:57Z · modified 2024-11-06T19:55:44Z · JSON