{"cve":"CVE-2024-53267","nvd":{"published":"2024-11-26T19:15:30.473","modified":"2026-06-17T08:08:43.360","status":"Deferred","description":"sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but \"mismatched\" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.verify(). The verifier may accept a bundle with an unrelated log entry, cryptographically verifying everything but fails to ensure the log entry applies to the artifact in question, thereby \"verifying\" a bundle without any proof the signing event was logged. This allows the creation of a bundle without fulcio certificate and private key combined with an unrelated but time-correct log entry to fake logging of a signing event. A malicious actor using a compromised identity may want to do this to prevent discovery via rekor's log monitors. The signer's identity will still be available to the verifier. The signature on the bundle must still be on the correct artifact for the verifier to pass. sigstore-gradle-plugin and sigstore-maven-plugin are not affected by this as they only provide signing functionality. This issue has been patched in v1.1.0 release with PR #856. All users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":5.5},"cwes":["CWE-347"],"references":["https://github.com/sigstore/sigstore-conformance/pull/166","https://github.com/sigstore/sigstore-java/pull/856","https://github.com/sigstore/sigstore-java/security/advisories/GHSA-q4xm-6fjc-5f6w"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-53267","score":0.00097,"percentile":0.00725,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q4xm-6fjc-5f6w","url":"https://osv.dev/vulnerability/GHSA-q4xm-6fjc-5f6w","summary":"sigstore-java has vulnerability with bundle verification","modified":"2024-12-09T17:00:45Z","packages":[{"ecosystem":"Maven","name":"dev.sigstore:sigstore-java","purl":"pkg:maven/dev.sigstore/sigstore-java","ranges":[">=1.0.0 <1.1.0"],"fixed":["1.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}