### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority. As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy. Note that this does not affect Cosign, as Cosign sets a threshold of 1. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Upgrade to v1.1.5. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround, beyond relying on trusted logs.
Update github.com/sigstore/sigstore-go to 1.2.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scansigstore-go has a multi-log threshold bypass via single compromised log affects github.com/sigstore/sigstore-go (go). Severity is medium. ### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority. As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy. Note that this does not affect Cosign, as Cosign sets a threshold of 1. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Upgrade to v1.1.5. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround, beyond relying on trusted logs.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority. As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy. Note that this does not affect Cosign, as Cosign sets a threshold of 1. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Upgrade to v1.1.5. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround, beyond relying on trusted logs.
Update github.com/sigstore/sigstore-go to 1.2.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scansigstore-go has a multi-log threshold bypass via single compromised log affects github.com/sigstore/sigstore-go (go). Severity is medium. ### Impact _What kind of vulnerability is it? Who is impacted?_ A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority. As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy. Note that this does not affect Cosign, as Cosign sets a threshold of 1. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Upgrade to v1.1.5. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround, beyond relying on trusted logs.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
| github.com/sigstore/sigstore-gogo | <=1.1.4 | 1.2.0 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Package | Affected range | Fixed version |
|---|
| github.com/sigstore/sigstore-gogo | <=1.1.4 | 1.2.0 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard