{"id":"CVE-2026-44310","sourceIdentifier":"security-advisories@github.com","published":"2026-05-15T17:16:47.430","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0."},{"lang":"es","value":"Gitsign es una herramienta de firma Sigstore sin clave para commits de Git con tu identidad de GitHub / OIDC. Desde la versión 0.4.0 hasta antes de la 0.15.0, CertVerifier.Verify() en pkg/git/verifier.go desreferencia incondicionalmente certs[0] después de sd.GetCertificates() sin verificar la longitud del slice. Un mensaje firmado CMS/PKCS7 con un conjunto de certificados vacío es una carga útil DER estructuralmente válida; GetCertificates() devuelve un slice vacío sin error, causando un pánico inmediato por índice fuera de rango. En la ruta de código gitsign --verify (el modo compatible con GPG invocado por git verify-commit), el pánico es recuperado silenciosamente por la función Wrap() de internal/io/streams.go, que devuelve nil en lugar de un error. main.go luego sale con el código 0, haciendo que los llamadores de verificación que solo dependen del código de salida interpreten la verificación fallida como un éxito. Esta vulnerabilidad se corrige en la versión 0.15.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sigstore","product":"gitsign","versions":[{"version":">= 0.4.0, < 0.15.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T16:44:32.980771Z","id":"CVE-2026-44310","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-390"}]}],"references":[{"url":"https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}