CVE-2024-55655

sigstore-python versions 2.0.0 to 3.5.9 insufficiently validate "integration time" in v2/v3 bundles, leading to potential DoS.

• CVSS 2.7
• CWE-20
• Input Validation and Sanitization
• Remote

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute their new entry's time. However, this would still be rejected at validation time, as the new entry's (valid) signed time would be outside the validity window of the original signing certificate and would nonetheless render the attacker auditable.

CVE

CVE-2024-55655

CWE

CWE-20

CVSS base score

2.7

Published

2024-12-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

sigstore-pyt

Fixed by upgrading

Yes

Solution

Upgrade to sigstore-python 3.6.0 or later.

def verify_bundle(bundle):

    try:
        integration_time = bundle["integration_time"]  
        signed_time_source = bundle.get("signed_time_source") 

        if signed_time_source:
            if not validate_integration_time(integration_time):
                 return False
        else:
            pass 

        return True
    except KeyError:
        return False


def validate_integration_time(time):
    return True

def verify_bundle(bundle):

    if bundle['version'] in ('v2', 'v3'):
        integration_time = bundle.get('integrationTime')
        signed_time_source = bundle.get('signedTimeSource')

        if integration_time is not None:
            if signed_time_source is None:
                if not validate_integration_time(integration_time):
                    raise ValueError("Invalid integration time")
            else:
                pass
        else:
            raise ValueError("Missing integration time")
        
def validate_integration_time(integration_time):
    from datetime import datetime, timedelta
    try:
        time = datetime.fromisoformat(integration_time)
        return (datetime.now(tz=time.tzinfo) - time) < timedelta(hours=24)
    except ValueError:
        return False

{
  "payloadType": "v2",
  "integrationTime": "2024-10-27T12:00:00Z" 
}

@misc{vaitp:cve202455655,
  title        = {{sigstore-python versions 2.0.0 to 3.5.9 insufficiently validate "integration time" in v2/v3 bundles, leading to potential DoS.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-55655},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-55655/}}
}