https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:40:22 +0000 https://db.gcve.eu/vuln/ghsa-fcv2-xgw5-pqxf <p><strong>Affected:</strong> Go: github.com/sigstore/sigstore</p> <p>## Summary</p> <p>The legacy TUF client `pkg/tuf/client.go`, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.</p> <p>Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.</p> <p>Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.</p> <p>## Impact</p> <p>A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.</p> <p>## Workarounds</p> <p>Users can disable disk caching for the legacy client by setting `SIGSTORE_NO_CACHE=true` in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> <p><strong>Affected:</strong> Go: github.com/sigstore/sigstore</p> <p>## Summary</p> <p>The legacy TUF client `pkg/tuf/client.go`, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.</p> <p>Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.</p> <p>Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.</p> <p>## Impact</p> <p>A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.</p> <p>## Workarounds</p> <p>Users can disable disk caching for the legacy client by setting `SIGSTORE_NO_CACHE=true` in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.</p> https://db.gcve.eu/vuln/ghsa-fcv2-xgw5-pqxf