{"metadata": {"vulnerability": "cve-2024-51746", "count": 25, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 17}}, "data": [{"timestamp": "2024-10-31T14:12:45.790Z", "date_only": false, "value": "2024-10-31T14:12:45.790Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-51746", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-11-05T15:26:57Z", "date_only": false, "value": "2024-11-05T15:26:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8PMP-678W-C8XX", "record": "GHSA-8PMP-678W-C8XX", "field": "published"}, {"timestamp": "2024-11-05T15:26:57Z", "date_only": false, "value": "2024-11-05T15:26:57.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-8pmp-678w-c8xx", "record": "CVE-2024-51746", "field": "creation_timestamp", "uuid": "a02fc277-badd-4aa6-9c47-50ef956b76e5", "url": "https://github.com/advisories/GHSA-8pmp-678w-c8xx"}, {"timestamp": "2024-11-05T18:54:39.494Z", "date_only": false, "value": "2024-11-05T18:54:39.494Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-51746", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-11-05T18:54:58.135Z", "date_only": false, "value": "2024-11-05T18:54:58.135Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2024-51746", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-05T19:15:08Z", "date_only": false, "value": "2024-11-05T19:15:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8PMP-678W-C8XX", "record": "GHSA-8PMP-678W-C8XX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-11-05T19:15:08.300Z", "date_only": false, "value": "2024-11-05T19:15:08.300", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-51746", "record": "FKIE_CVE-2024-51746", "field": "published"}, {"timestamp": "2024-11-05T20:18:07.672Z", "date_only": false, "value": "2024-11-05T20:18:07.672798Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-51746", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-11-05T20:18:07.672Z", "date_only": false, "value": "2024-11-05T20:18:07.672798Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-51746", "record": "FKIE_CVE-2024-51746", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-11-05T20:30:02.393Z", "date_only": false, "value": "2024-11-05T20:30:02.393Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-51746", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-11-05T20:30:02.393Z", "date_only": false, "value": "2024-11-05T20:30:02.393Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-51746", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-11-05T21:25:33Z", "date_only": false, "value": "2024-11-05T21:25:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/9933", "record": "CVE-2024-51746", "field": "creation_timestamp", "uuid": "fca08e3a-d9a1-4eff-9613-428fa8e04130", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-51746 - GitHub OIDC Gitsign Incorrect Rekor Entry Selection\", \n  \"Content\": \"CVE ID : CVE-2024-51746 \nPublished : Nov. 5, 2024, 7:15 p.m. | 42\u00a0minutes ago \nDescription : Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Nov 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/9933"}, {"timestamp": "2024-11-06T19:55:44Z", "date_only": false, "value": "2024-11-06T19:55:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8PMP-678W-C8XX", "record": "GHSA-8PMP-678W-C8XX", "field": "modified"}, {"timestamp": "2024-11-07T00:00:00Z", "date_only": false, "value": "2024-11-07T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-11-07T00:00:00Z", "date_only": false, "value": "2024-11-07T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-11-07T00:00:00Z", "date_only": false, "value": "2024-11-07T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-07T00:00:00Z", "date_only": false, "value": "2024-11-07T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-11-22T10:44:11Z", "date_only": false, "value": "2024-11-22T10:44:11Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2024:4042-1", "record": "SUSE-SU-2024:4042-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-11-22T10:44:11Z", "date_only": false, "value": "2024-11-22T10:44:11Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2024:4042-1", "record": "SUSE-SU-2024:4042-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2024-11-22T10:44:11Z", "date_only": false, "value": "2024-11-22T10:44:11Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2024:4042-1", "record": "SUSE-SU-2024:4042-1", "field": "document.tracking.generator.date"}, {"timestamp": "2024-11-22T10:44:11Z", "date_only": false, "value": "2024-11-22T10:44:11Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2024:4042-1", "record": "SUSE-SU-2024:4042-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-11-22T10:44:11Z", "date_only": false, "value": "2024-11-22T10:44:11Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2024:4042-1", "record": "SUSE-SU-2024:4042-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-17T08:06:14.353Z", "date_only": false, "value": "2026-06-17T08:06:14.353", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-51746", "record": "FKIE_CVE-2024-51746", "field": "lastModified"}, {"timestamp": "2026-09-20T21:20:32Z", "date_only": false, "value": "2026-09-20T21:20:32Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:20:32Z", "date_only": false, "value": "2026-09-20T21:20:32Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2024:14470-1", "record": "OPENSUSE-SU-2024:14470-1", "field": "document.tracking.current_release_date"}]}