| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| sigstore | < 4.2.0 | 4.2.0 |
| sigstore-python | < 4.2.0 | 4.2.0 |
The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.
_OAuthSession creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.
Fix should be fairly trivial.
This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン