https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 03 Aug 2026 21:07:44 +0000 https://vulnerability.circl.lu/sighting/5c0fbb16-440f-4455-9a59-aa8e4e100c69/export {"uuid": "5c0fbb16-440f-4455-9a59-aa8e4e100c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5yafsgae3owcl", "content": "CVE-2026-54787 - sigstore-go fails to check signature timestamps against a signing key's validity period\nCVE ID : CVE-2026-54787\n \n Published : July 31, 2026, 11:17 p.m. | 31\u00a0minutes ago\n \n Description : sigstore-go is a Go library for Sigstore signing and verification. Prior ...", "creation_timestamp": "2026-08-01T00:00:23.977586Z"} {"uuid": "5c0fbb16-440f-4455-9a59-aa8e4e100c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5yafsgae3owcl", "content": "CVE-2026-54787 - sigstore-go fails to check signature timestamps against a signing key's validity period\nCVE ID : CVE-2026-54787\n \n Published : July 31, 2026, 11:17 p.m. | 31\u00a0minutes ago\n \n Description : sigstore-go is a Go library for Sigstore signing and verification. Prior ...", "creation_timestamp": "2026-08-01T00:00:23.977586Z"} https://vulnerability.circl.lu/sighting/5c0fbb16-440f-4455-9a59-aa8e4e100c69/export Sat, 01 Aug 2026 00:00:23 +0000 https://vulnerability.circl.lu/sighting/f1e6e9b2-034b-4535-ba80-8b2397073775/export {"uuid": "f1e6e9b2-034b-4535-ba80-8b2397073775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:00:16.243622Z"} {"uuid": "f1e6e9b2-034b-4535-ba80-8b2397073775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:00:16.243622Z"} https://vulnerability.circl.lu/sighting/f1e6e9b2-034b-4535-ba80-8b2397073775/export Sat, 01 Aug 2026 00:00:16 +0000 https://vulnerability.circl.lu/sighting/b25b05a0-a45a-498e-b8ae-bb0ffa695a02/export {"uuid": "b25b05a0-a45a-498e-b8ae-bb0ffa695a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T22:32:31.622301Z"} {"uuid": "b25b05a0-a45a-498e-b8ae-bb0ffa695a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T22:32:31.622301Z"} https://vulnerability.circl.lu/sighting/b25b05a0-a45a-498e-b8ae-bb0ffa695a02/export Fri, 31 Jul 2026 22:32:31 +0000