CVE-2026-44310— gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

对数组索引的验证不恰当

Gitsign 输入验证错误漏洞

Gitsign是Gitsign个人开发者的一个能够免密钥完成对Git提交进行签名的工具。 Gitsign 0.4.0至0.15.0之前版本存在输入验证错误漏洞，该漏洞源于CertVerifier.Verify()在sd.GetCertificates()后无条件解引用certs[0]而未检查切片长度，CMS/PKCS7签名消息的空证书集是结构有效的DER有效载荷，GetCertificates()返回空切片且无错误，导致立即索引越界恐慌，在gitsign --verify代码路径中恐慌被静默恢复并返回ni

N/A

N/A