CyberRota Analysis
AI-GeneratedThe vulnerability affects the sigstore-js library used in JavaScript applications for interacting with Sigstore services, specifically in the sigstore.verify() function where the certificateOIDs option is ignored. As a result, applications may inadvertently accept unauthorized certificates, undermining the integrity of artifact signing processes. Organizations utilizing this library should prioritize updating to version 4.1.1 to mitigate the risk of unauthorized certificate acceptance.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.