Update module github.com/sigstore/sigstore-go to v1.2.0 [SECURITY] (main)#3399
Update module github.com/sigstore/sigstore-go to v1.2.0 [SECURITY] (main)#3399renovate[bot] wants to merge 1 commit into
Conversation
ℹ️ Artifact update noticeFile name: acceptance/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
🤖 Finished Review · ✅ Success · Started 8:43 PM UTC · Completed 8:48 PM UTC |
ReviewVerdict: Comment — medium-severity observation, non-blocking. This is a Renovate-generated dependency bump updating The PR correctly updates the acceptance module. No source code, tests, or configuration files are modified. No secrets, injection patterns, or permission changes detected. Findings⚠ Medium — Incomplete security fix across modulesFile: The root While the vulnerability specifically requires multi-log threshold configurations (N>1) and may not be exploitable in all usage patterns, the production binary is built from the root module. No other open PR currently addresses the root module update. Remediation: Update Review dimensions
Previous runReview — approveSecurity dependency update — sigstore-go v1.1.4 → v1.2.0 (CVE-2026-49834) This Renovate bot PR updates What was reviewed
AssessmentCorrectness: The Security: The PR correctly patches CVE-2026-49834 in the acceptance test module. The vulnerability requires configuring Scope: Changes are entirely within the Compatibility risk: Low. While the transitive dependency changes are extensive, they are managed by Go's module system and the acceptance test suite will validate compatibility. Finding
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/main-go-github.com-sigstore-sigstore-go-vulnerability
branch
from
501eda7 to
076ea61
Compare
|
🤖 Finished Review · ✅ Success · Started 7:57 PM UTC · Completed 8:02 PM UTC |
fullsend-ai-review
Bot
added
requires-manual-review
This PR contains the following updates:
v1.1.4→v1.2.0sigstore-go has a multi-log threshold bypass via single compromised log
CVE-2026-49834 / GHSA-9vcr-p3rj-q5q6
More information
Details
Impact
What kind of vulnerability is it? Who is impacted?
A verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority.
As a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy.
Note that this does not affect Cosign, as Cosign sets a threshold of 1.
Patches
Has the problem been patched? What versions should users upgrade to?
Upgrade to v1.1.5.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
There is no workaround, beyond relying on trusted logs.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sigstore/sigstore-go (github.com/sigstore/sigstore-go)
v1.2.0Compare Source
What's Changed
New Contributors
Full Changelog: sigstore/sigstore-go@v1.1.4...v1.2.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.