Listen to this Post
sigstore-go is a Go library for Sigstore signing and verification. Prior to version 1.2.1, the library contains a vulnerability in how it handles signature verification for self-managed long-lived keys that do not have an associated certificate. To verify a bundle with such a key, the key must be wrapped in an `ExpiringKey` type, which is designed to enforce expiration semantics by defining a validity window (start and end time). Despite this API contract, the bundle verification logic neglects to cross-reference the signing timestamp of the bundle against the validity period of the wrapping ExpiringKey. This oversight means that even if a key is expired, signatures created with that key may still be accepted as valid. An attacker who obtains expired key materials could therefore sign bundles that are accepted by the verifier, effectively bypassing the intended time-based expiration policy. This issue only impacts the long-lived signing key workflow and does not affect standard deployments that involve a certificate authority. The vulnerability is classified as CWE-324: Use of a Key Past its Expiration Date. The issue was fixed in version 1.2.1 by implementing proper timestamp validation against key validity windows.
DailyCVE Form:
Platform: sigstore-go
Version: < 1.2.1
Vulnerability: timestamp validation bypass
Severity: LOW (CVSS 3.1)
date: 2026-08-01
Prediction: 2026-07-31 (fixed)
What Undercode Say:
The vulnerability stems from a missing temporal check in the bundle verification pipeline. The `ExpiringKey` wrapper provides the validity window, but the verifier does not use it. Below are reproduction steps and analytics.
Clone the sigstore-go repository git clone https://github.com/sigstore/sigstore-go.git cd sigstore-go Checkout the vulnerable commit git checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16 Apply the test case patch git apply sigstore-go-public-key-validity-test.patch Run the test that should fail on vulnerable code go test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp On vulnerable code, the test fails because verification succeeds even though the trusted ExpiringKey is not valid at the signed timestamp: FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp signed_entity_test.go:602: Error: An error is expected but got nil.
Exploit:
An attacker with access to expired key materials can craft a bundle and sign it using the expired key. Because sigstore-go does not check the signing timestamp against the key’s validity window, the verification process will accept the bundle as valid. The attack requires network access and low privileges, with high attack complexity.
Protection:
Upgrade to sigstore-go version 1.2.1 or later, which includes the fix that properly validates the signing timestamp against the `ExpiringKey` validity window. Additionally, audit existing signing infrastructure for any expired keys that may have been used and implement stricter key lifecycle management policies.
Impact:
This vulnerability allows attackers to bypass time-based key expiration policies, potentially enabling supply chain attacks where malicious actors use expired but still functional key material to compromise software integrity. Organizations using affected versions face potential compromise of their software distribution pipeline. The CVSS score is 3.1 (Low), with no impact on confidentiality or availability, but low integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
