From cc37946dec4ffa1b58b0747e2ccfed7701a0bb51 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 5 Nov 2024 16:55:58 +0000
Subject: [PATCH] Publish GHSA-8pmp-678w-c8xx

---
 .../2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json b/advisories/github-reviewed/2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json
index 4b4d880feda..2dea69d2a94 100644
--- a/advisories/github-reviewed/2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json
+++ b/advisories/github-reviewed/2024/11/GHSA-8pmp-678w-c8xx/GHSA-8pmp-678w-c8xx.json
@@ -1,10 +1,10 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8pmp-678w-c8xx",
-  "modified": "2024-11-05T15:26:57Z",
+  "modified": "2024-11-05T16:54:13Z",
   "published": "2024-11-05T15:26:57Z",
   "aliases": [
-
+    "CVE-2024-51746"
   ],
   "summary": "gitsign may use incorrect Rekor entries during verification",
   "details": "### Summary\n\ngitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log.\n\n### Details\n\ngitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match _either_ condition rather than _both_. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification.\n\n### PoC\n\nEnable the credential cache and create commit signatures using the cached signing certificate. `gitsign verify` or `git log --show-signature` will demonstrate the use of the wrong entry index for the corresponding commit. Note that this depends on the order of matching entries in the response from the Rekor search API, so it may take a few attempts to trigger this.\n\n### Impact\n\nMinimal. While gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder.",