High, CVSS 7.5RubyGemsPublished
sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
CVE-2026-31830 · GHSA-mhg6-2q2v-9h2c
- Affected
- RubyGems sigstore < 0.2.3
- Fixed in
- 0.2.3· Vendor fix available
- Issue
- Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. Details In lib/sigstore/verifier.rb, the verify method calls verifyintoto (line 176) without capturing or checking its return value: verifyintoto(input, intoto) When verifyintoto detects a digest mismatch, it returns a VerificationFailure object. Because the caller discards this return value, execution unconditionally falls through to return VerificationSuccess. This is the only verification sub-check in the method (out of 12) whose failure is not propagated. The messagesignature code path is not affected. Impact An attacker who possesses a valid signed DSSE bundle containing an in-toto attestation for artifact A can present it as a…
Recommended action: Upgrade to 0.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.