PyPI/sigstore CVE-2024-55655: low 2.7, EPSS 0.25%
sigstore has insufficient validation of integration timestamp during verification
Action: Upgrade sigstore to 3.6.0 or later.
pip install sigstore==3.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 3.6.0 | - |
Fixed versions
| 3.6.0 |
Sources
- osv: GHSA-hhfg-fwrw-87w7
- nvd: CVE-2024-55655
- https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hhfg-fwrw-87w7
- https://github.com/sigstore/sigstore-python/commit/300b502ae99ebfaace124f1f4e422a6a669369cf
- https://github.com/sigstore/sigstore-python
- https://github.com/sigstore/sigstore-python/releases/tag/v3.6.0
CVE-2024-55655 · published · modified · JSON