Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/sigstore/timestamp-authority/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5GoPublished

    Sigstore Timestamp Authority has Improper Certificate Validation in verifier

    CVE-2026-39984 · GHSA-xm5m-wgh2-rrg3

    Affected
    • Go github.com/sigstore/timestamp-authority/v2 <= 2.0.5
    Fixed in
    2.0.6· Vendor fix available
    Issue
    Authorization bypass via certificate bag manipulation in sigstore/timestamp-authority verifier An authorization bypass vulnerability exists in sigstore/timestamp-authority verifier (timestamp-authority/v2/pkg/verification): VerifyTimestampResponse function correctly verifies the certificate chain but when the TSA specific constraints are verified in VerifyLeafCert, the first non-CA certificate from the PKCS#7 certificate bag is used instead of the leaf certificate from the certificate chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key. The library validates the signature using the one certificate but performs authorization checks on the another, allowing an attacker to bypass some authorization controls. This vulnerability does not apply to timestamp-authority service, only to users of timestamp-authority/v2/pkg/verification package. This vulnerability does not apply to sigstore-go even…

    Recommended action: Upgrade to 2.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →