CVE-2026-31830

Description

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.

PUBLISHED Reserved 2026-03-09 | Published 2026-03-10 | Updated 2026-03-11 | Assigner GitHub_M

Problem types

CWE-252: Unchecked Return Value

Product status

References

github.com/...e-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c

cve.org (CVE-2026-31830)

nvd.nist.gov (CVE-2026-31830)

Download JSON