CyberRota Analysis
AI-GeneratedThe vulnerability affects the @sigstore/verify library in versions prior to 3.1.1, which is used for interacting with Sigstore services in JavaScript. An attacker can exploit this flaw by supplying an untrusted bundle, potentially influencing certificate validity and timestamp verification processes. Organizations utilizing this library should prioritize updating to version 3.1.1 to mitigate the risk of unauthorized certificate manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.