CVE-2023-47122

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-471235.4iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be p CVE-2023-471245.9Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew CVE-2023-471256.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions CVE-2023-471265.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the sta CVE-2023-471275.4TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least CVE-2023-471289.1Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction CVE-2023-471299.8Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset CVE-2023-47138.8A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function addComment of the file ?CVE-2023-471309.8Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application CVE-2023-471317.5The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.CVE-2023-471329.8An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.CVE-2023-47147.5A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redir