GHSA-h829-5cg7-6hff: Github.com/supply chain tools/gitverify Gitverify Has Improper Tag Signature Vulnerability

MODERATE
Share
CWE-347
Published
Advisory Summary

GHSA-h829-5cg7-6hff is a MODERATE gitverify has improper tag signature vulnerability (CWE-347: Improper Verification of Cryptographic Signature) affecting Github.com/supply chain tools/gitverify libraries in the Go ecosystem. The issue involves gitverify has improper tag signature verification. Remediation is available by upgrading affected packages to version 0.0.0-20260421124901-c2c60da05d5c.

GHSA-h829-5cg7-6hff at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-h829-5cg7-6hff
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-347: Improper Verification of Cryptographic Signature
Affected Product Github.com/supply chain tools/gitverify
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-h829-5cg7-6hff

To remediate this vulnerability, upgrade all affected Github.com/supply chain tools/gitverify dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/supply-chain-tools/gitverify fixed: 0.0.0-20260421124901-c2c60da05d5c 
Upgrade github.com/supply-chain-tools/gitverify to 0.0.0-20260421124901-c2c60da05d5c
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/supply-chain-tools/gitverify

How to Check if You Are Affected

To determine whether your application is affected by GHSA-h829-5cg7-6hff, inspect your project dependencies for Github.com/supply chain tools/gitverify:

inspect dependencies for github.com/supply-chain-tools/gitverify

Analyze the terminal output to locate any version of Github.com/supply chain tools/gitverify in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260421124901-c2c60da05d5c), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-347: Improper Verification of Cryptographic Signature, where the product does not verify, or incorrectly verifies, the cryptographic signature for data. In Github.com/supply chain tools/gitverify, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

gitverify is still a prototype. ### Impact The bug is related to `requireSignedTags` which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor. ### Patches Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet). ### Workarounds No

GHSA-h829-5cg7-6hff Affected Github.com/supply chain tools/gitverify Versions

1 component(s)
Fixed Versions:
0.0.0-20260421124901-c2c60da05d5c
Product / Package Ecosystem Affected Versions Fixed Version
github.com/supply-chain-tools/gitverify
golang/github.com/supply-chain-tools/gitverify
Go
< 0.0.0-20260421124901-c2c60da05d5c
0.0.0-20260421124901-c2c60da05d5c

References

GitHub Advisory / Wiki ADVISORY
https://github.com/supply-chain-tools/gitverify/security/advisories/GHSA-h829-5cg7-6hff
Security Fix Commit FIX COMMIT
https://github.com/supply-chain-tools/gitverify/commit/c2c60da05d5c73621d0ce7ea02770bacd79ec8b1
Github.com/supply chain tools/gitverify Source Repository REPOSITORY
https://github.com/supply-chain-tools/gitverify

Frequently Asked Questions

What is GHSA-h829-5cg7-6hff?
GHSA-h829-5cg7-6hff is a security vulnerability in Github.com/supply chain tools/gitverify involving gitverify has improper tag signature verification under CWE-347: Improper Verification of Cryptographic Signature.
Which Github.com/supply chain tools/gitverify versions are affected?
Affected versions include releases prior to 0.0.0-20260421124901-c2c60da05d5c across affected packages: github.com/supply-chain-tools/gitverify.
What version fixes GHSA-h829-5cg7-6hff?
Upgrading to 0.0.0-20260421124901-c2c60da05d5c (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/supply-chain-tools/gitverify affected?
Yes, github.com/supply-chain-tools/gitverify is affected in releases prior to 0.0.0-20260421124901-c2c60da05d5c. Upgrade your dependency to 0.0.0-20260421124901-c2c60da05d5c or later.
What CWE is associated with GHSA-h829-5cg7-6hff?
GHSA-h829-5cg7-6hff is classified under CWE-347: Improper Verification of Cryptographic Signature (The product does not verify, or incorrectly verifies, the cryptographic signature for data.).
How can I check Go dependencies for GHSA-h829-5cg7-6hff?
Run the dependency tree command: 'inspect dependencies for github.com/supply-chain-tools/gitverify'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h829-5cg7-6hff",
  "modified" : "2026-04-24T20:42:22Z",
  "published" : "2026-04-24T20:42:22Z",
  "aliases" : [ ],
  "summary" : "gitverify has improper tag signature verification",
  "details" : "gitverify is still a prototype.\n\n### Impact\nThe bug is related to `requireSignedTags` which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor.\n\n### Patches\nSince the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet).\n\n### Workarounds\nNo",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/supply-chain-tools/gitverify"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260421124901-c2c60da05d5c"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/supply-chain-tools/gitverify/security/advisories/GHSA-h829-5cg7-6hff"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/supply-chain-tools/gitverify/commit/c2c60da05d5c73621d0ce7ea02770bacd79ec8b1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/supply-chain-tools/gitverify"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-347" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-24T20:42:22Z",
    "nvd_published_at" : null
  }
}