Sigstore-go Multi-Log Policy Bypass via Single Compromised Log

Executive Summary

This vulnerability in sigstore-go (versions before 1.2.0) allows a single compromised transparency log or CT log to bypass multi-log threshold security policies. The verifier incorrectly counted verified witnesses per entry rather than per log authority, enabling a malicious log to forge multiple entries or verify multiple times to meet threshold requirements without actual redundancy.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the sigstore-go library versions prior to 1.2.0. To detect it, check the installed version of sigstore-go in your Go modules or dependencies using commands like 'go list -m sigstore/sigstore-go' or inspecting go.mod files. If the version is less than 1.2.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this could bypass intended multi-log security defenses, potentially allowing forged signatures or certificates to be accepted as valid. This undermines the integrity of the verification process, enabling unauthorized access or data tampering if logs are compromised.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by weakening the integrity of digital signatures and verification processes, which are often required for audit trails and data integrity in GDPR and HIPAA. Compromised logs might allow unauthorized changes to be undetected, violating non-repudiation and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade sigstore-go to version 1.2.0 or later to address the multi-log threshold bypass vulnerability. Verify the installed version with 'go list -m sigstore.dev/sigstore-go' and update dependencies accordingly.

Useful 0 Not Useful 0