Vulnerabilities in pkg:golang/github.com/sigstore/sigstore-go

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wqqc-jjcq-vfxm",
  "modified" : "2026-07-31T21:58:39Z",
  "published" : "2026-07-31T21:58:39Z",
  "aliases" : [ "CVE-2026-54787" ],
  "summary" : "sigstore-go fails to check signature timestamps against a signing key's validity period",
  "details" : "sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.\n\n## Impact\n\nTo verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an `ExpiringKey` type that implies expiration semantics:\n\n```go\nsignatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)\nexpiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))\n```\n\nDespite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.\n\n## Reproduction steps\n\nStart from a sigstore-go checkout:\n\n```bash\ngit clone https://github.com/sigstore/sigstore-go.git\ncd sigstore-go\ngit checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16\n```\n\nApply the [patch] containing the test case and associated materials:\n\n```bash\ngit apply sigstore-go-public-key-validity-test.patch\n```\n\nRun the test:\n\n```bash\ngo test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp\n```\n\nOn vulnerable code, the test fails because verification succeeds even though the trusted `ExpiringKey` is not valid at the signed timestamp:\n\n```text\n--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp\n    signed_entity_test.go:602:\n        \tError:      \tAn error is expected but got nil.\n```\n\n[patch]: https://github.com/user-attachments/files/28614520/sigstore-go-public-key-validity-test.patch",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/sigstore/sigstore-go"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.2.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.2.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sigstore/sigstore-go/pull/642"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/sigstore/sigstore-go"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-324" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-31T21:58:39Z",
    "nvd_published_at" : null
  }
}