Detections
Analytics

SCA: security update for dev.sigstore:sigstore-java (GHSA-jp26-88mw-89qr)

low Tenable Cloud Security Plugin ID 416478

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has
 insufficient verification for a situation where a bundle provides a invalid signature for a checkpoint.
 This bug impacts clients using any variation of KeylessVerifier.verify(). Currently checkpoints are only
 used to ensure the root hash of an inclusion proof was provided by the log in question. Failing to
 validate that means a bundle may provide an inclusion proof that doesn't actually correspond to the log in
 question. This may eventually lead a monitor/witness being unable to detect when a compromised logs are
 providing different views of themselves to different clients. There are other mechanisms right now that
 mitigate this, such as the signed entry timestamp. Sigstore-java currently requires a valid signed entry
 timestamp. By correctly verifying the signed entry timestamp we can make certain assertions about the log
 signing the log entry (like the log was aware of the artifact signing event and signed it). Therefore the
 impact on clients that are not monitors/witnesses is very low. This vulnerability is fixed in 1.2.0.
 (CVE-2024-54140)

See Also

https://github.com/advisories/GHSA-jp26-88mw-89qr

Plugin Details

Severity: Low

ID: 416478

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.49

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2024-54140

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.1

Threat Score: 0.5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/5/2024

Vulnerability Publication Date: 12/5/2024

Reference Information

CVE: CVE-2024-54140

cwe: CWE-20