Medium severity · published Nov 10, 2023
CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Gitsign · Sigstore
0.6.0 before 0.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47122
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47122
Product
https://docs.sigstore.dev/about/threat-model/#sigstore-threat-model
Patch
https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236
Patch
https://github.com/sigstore/gitsign/pull/399
Patch
https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vc
More from Gitsign
5.4
CVE-2026-44310
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
5.3
CVE-2026-44309
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits