CVE-2023-47122

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.

• CWE-347

• https://docs.sigstore.dev/about/threat-model/#sigstore-threat-modelProduct
• https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236Patch
• https://github.com/sigstore/gitsign/pull/399Patch
• https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vcPatch, Vendor Advisory
• https://docs.sigstore.dev/about/threat-model/#sigstore-threat-modelProduct
• https://github.com/sigstore/gitsign/commit/cd66ccb03c86a3600955f0c15f6bfeb75f697236Patch
• https://github.com/sigstore/gitsign/pull/399Patch
• https://github.com/sigstore/gitsign/security/advisories/GHSA-xvrc-2wvh-49vcPatch, Vendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47117Label Studio is an open source data labeling tool. In all cu…7.5
• CVE-2023-47118ClickHouse® is an open-source column-oriented database manag…9.8
• CVE-2023-47119Discourse is an open source platform for community discussio…6.1
• CVE-2023-4712A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-47120Discourse is an open source platform for community discussio…7.5
• CVE-2023-47121Discourse is an open source platform for community discussio…9.8
• CVE-2023-47123iTop is an IT service management platform. By filling malic…5.4
• CVE-2023-47124Traefik is an open source HTTP reverse proxy and load balanc…5.9
• CVE-2023-47125TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2023-47126TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2023-47127TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2023-47128Piccolo is an object-relational mapping and query builder wh…9.1