| Package | Affected versions | Patched versions |
|---|---|---|
| sigstore | < 4.2.0 | 4.2.0 |
| sigstore-python | < 4.2.0 | 4.2.0 |
The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.
_OAuthSession creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.
Fix should be fairly trivial.
This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free