https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:04:58 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-fx79373 <p><strong>Affected:</strong> CleanStart: pulumi, CleanStart: renovate</p> <p>CVE-2026-48816 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: pulumi, CleanStart: renovate</p> <p>CVE-2026-48816 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-fx79373 https://cve.radiocsirt.org/vuln/euvd-2026-337995 EUVD-2026-337995 https://cve.radiocsirt.org/vuln/euvd-2026-337995 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48816 <p>sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.</p> <p>sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48816 https://cve.radiocsirt.org/vuln/ghsa-xgjw-pm74-86q4 <p><strong>Affected:</strong> npm: @sigstore/verify</p> <p>sigstore-js derives a transparency-log timestamp from `tlogEntries[].integratedTime` and uses it to validate certificate validity windows and satisfy `timestampThreshold`. For bundle v0.2, a tlog entry can be inclusionProof-only (no signed inclusionPromise/set), and the inclusion proof path does not cryptographically bind `integratedTime`. As a result, an attacker who can supply an untrusted bundle can influence time-based verification decisions by choosing `integratedTime`.</p> <p>## impact If a consumer accepts attacker-provided bundle v0.2 inputs and relies on tlog-derived timestamps for certificate validity checks, verification can be influenced by an unauthenticated timestamp value. This is a trust gap: `integratedTime` is treated as a trusted observer timestamp under inclusionProof-only mode even though only the signed inclusionPromise/set path binds it.</p> <p>## affected code - `packages/verify/src/bundle/index.ts` (adds a transparency-log timestamp whenever `integratedTime != 0`) - `packages/verify/src/timestamp/index.ts` (converts `integratedTime` to a `Date`) - `packages/verify/src/verifier.ts` (verifies timestamps before verifying tlog inclusion) - `packages/verify/src/tlog/index.ts` + `packages/verify/src/tlog/set.ts` (only the inclusionPromise/set path binds `integratedTime`)</p> <p>## proof of concept The attached `poc.zip` contains a self-contained harness that reproduces the behavior on the pinned commit and includes both a canonical test and a negative control.</p> <p>repro: 1) ex…</p> <p><strong>Affected:</strong> npm: @sigstore/verify</p> <p>sigstore-js derives a transparency-log timestamp from `tlogEntries[].integratedTime` and uses it to validate certificate validity windows and satisfy `timestampThreshold`. For bundle v0.2, a tlog entry can be inclusionProof-only (no signed inclusionPromise/set), and the inclusion proof path does not cryptographically bind `integratedTime`. As a result, an attacker who can supply an untrusted bundle can influence time-based verification decisions by choosing `integratedTime`.</p> <p>## impact If a consumer accepts attacker-provided bundle v0.2 inputs and relies on tlog-derived timestamps for certificate validity checks, verification can be influenced by an unauthenticated timestamp value. This is a trust gap: `integratedTime` is treated as a trusted observer timestamp under inclusionProof-only mode even though only the signed inclusionPromise/set path binds it.</p> <p>## affected code - `packages/verify/src/bundle/index.ts` (adds a transparency-log timestamp whenever `integratedTime != 0`) - `packages/verify/src/timestamp/index.ts` (converts `integratedTime` to a `Date`) - `packages/verify/src/verifier.ts` (verifies timestamps before verifying tlog inclusion) - `packages/verify/src/tlog/index.ts` + `packages/verify/src/tlog/set.ts` (only the inclusionPromise/set path binds `integratedTime`)</p> <p>## proof of concept The attached `poc.zip` contains a self-contained harness that reproduces the behavior on the pinned commit and includes both a canonical test and a negative control.</p> <p>repro: 1) ex…</p> https://cve.radiocsirt.org/vuln/ghsa-xgjw-pm74-86q4