CVE-2024-54140

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint. This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are providing different views of themselves to different clients. There are other mechanisms right now that mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0.

• CWE-20

• https://github.com/sigstore/sigstore-conformance/pull/139
• https://github.com/sigstore/sigstore-java/commit/23fb4885e6704a5df4977f7acf253a745349edf9
• https://github.com/sigstore/sigstore-java/security/advisories/GHSA-jp26-88mw-89qr

Published

Dec 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54135ClipBucket V5 provides open source video hosting with PHP. C…8.8
• CVE-2024-54136ClipBucket V5 provides open source video hosting with PHP. C…9.8
• CVE-2024-54137liboqs is a C-language cryptographic library that provides i…7.5
• CVE-2024-54138NuGet Gallery is a package repository that powers nuget.org.…6.1
• CVE-2024-54139Combodo iTop is an open source and web-based IT service mana…9.6
• CVE-2024-5414A vulnerability have been discovered in PhpMyBackupPro affec…7.1
• CVE-2024-54141phpMyFAQ is an open source FAQ web application for PHP 8.1+ …7.5
• CVE-2024-54142Discourse AI is a Discourse plugin which provides a number o…9
• CVE-2024-54143openwrt/asu is an image on demand server for OpenWrt based d…9.3
• CVE-2024-54145Cacti is an open source performance and fault management fra…8.8
• CVE-2024-54146Cacti is an open source performance and fault management fra…8.8
• CVE-2024-54147Altair is a GraphQL client for all platforms. Prior to versi…6.8