What is CVE-2024-55655?

CVE-2024-55655 is a vulnerability in Sigstore Sigstore-python, classified under Improper Input Validation. Published 2024-12-10.

Is CVE-2024-55655 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Sigstore Sigstore-python

CVE-2024-55655

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles d…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (14.3th percentile) — read the EPSS interpretation.

Affected products

Sigstore Sigstore-python — versions >= 2.0.0, < 3.6.0

Weakness classification (CWE)

Public proof-of-concept exploits

trailofbits/publications

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-55655?: CVE-2024-55655 is a vulnerability in Sigstore Sigstore-python, classified under Improper Input Validation. Published 2024-12-10.
Is CVE-2024-55655 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.