CVE-2024-54140

Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to 1.2.0

Description: The issue is related to insufficient verification for a situation where a bundle provides an invalid signature for a checkpoint. This affects clients using any variation of KeylessVerifier.verify(). The impact is low for clients that are not monitors or witnesses, as other mechanisms like signed entry timestamps mitigate this issue. A valid signed entry timestamp is still required for verification to pass.

Recommendations: For versions prior to 1.2.0, update to version 1.2.0 to fix the issue. As a temporary workaround, verifiers may choose to verify the checkpoint manually after running KeylessVerifier.verify() by using the provided Java code to manually verify the checkpoint signature.