Repository navigation
Update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [SECURITY] (release-v0.8) - autoclosed - #1900
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
|
🤖 Finished Review · ✅ Success · Started 2:39 PM UTC · Completed 2:45 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.36 |
|
<!-- fullsend:risk-assessment --> DetailsRoutine automated security dependency update from renovate[bot] touching only go.mod and go.sum files across main and acceptance modules; elevated dependency file count (>=2) and large blast radius are the primary Tier 1 drivers but are offset by bot authorship, absence of protected paths, and no CI changes — git history shows moderate churn consistent with active dependency management; anchored to prior score of 2 as all signals are unchanged. Previous run<!-- fullsend:risk-assessment --> DetailsRoutine automated dependency update from renovate[bot] touching only go.mod and go.sum files; dependency file count (>=2) remains the primary Tier 1 driver, git history shows moderate churn consistent with active dependency management, offset by bot authorship and absence of protected paths or CI changes — anchored to prior score of 2 as signals are unchanged. Previous run (2)Risk Assessment: moderate (2/5) DetailsRoutine automated dependency update from renovate[bot] touching only go.mod and go.sum files with no security-sensitive changes; elevated dependency file count (≥2) is the primary risk driver, offset by bot authorship and absence of protected paths or CI changes. |
|
Looks good to me Previous run<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJhcHByb3ZlIiwiZmluZGluZ3MiOltdfQ== --> Looks good to me Previous run (2)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJhcHByb3ZlIiwiZmluZGluZ3MiOltdfQ== --> Looks good to me |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
ℹ️ Artifact update noticeFile name: acceptance/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
b129283 to
d90c505
Compare
b4e7797 to
c50e5a7
Compare
|
🤖 Review · Commit: |
fullsend-ai-review
Bot
removed
the
ready-for-merge
c50e5a7 to
fd3481b
Compare
|
🤖 Finished Review · ✅ Success · Started 3:15 PM UTC · Completed 3:28 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.87 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Superseded by updated review
fullsend-ai-review
Bot
added
the
ready-for-merge
fd3481b to
a2df1c8
Compare
|
🤖 Finished Review · ✅ Success · Started 10:13 AM UTC · Completed 10:26 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.82 |
fullsend-ai-review
Bot
removed
the
ready-for-merge
Superseded by updated review
fullsend-ai-review
Bot
added
the
ready-for-merge
a2df1c8 to
a4c5627
Compare
|
🤖 Finished Review · ✅ Success · Started 3:49 PM UTC · Completed 4:01 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.05 |
fullsend-ai-review
Bot
removed
the
ready-for-merge
renovate
Bot
changed the title
|
Review skipped — this PR is already closed. The Posted by fullsend post-review check |
|
🤖 Finished Retro · ✅ Success · Started 4:01 PM UTC · Completed 4:13 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.75 |
Retro: PR #1900 — ~$13 spent reviewing an autoclosed Renovate PRPR #1900 was a Renovate bot security dependency update (
The final review (Oct 27) started at 15:49 UTC; the PR was autoclosed at 15:59 — during the review. The post-review script caught the closed state and posted a skip comment, but the $4.05 was already spent. All findings covered by existing issuesEvery improvement opportunity identified is already tracked by an open issue with active work:
Judge scores
No new proposals filed — existing issues comprehensively cover all identified improvements. Merging PR #1932 would prevent this class of waste for Renovate PRs in conforma/policy. |
This PR contains the following updates:
v2.0.6→v2.1.0v2.0.4→v2.1.0Sigstore Timestamp Authority has Improper Certificate Validation in verifier
CVE-2026-39984 / GHSA-xm5m-wgh2-rrg3
More information
Details
Authorization bypass via certificate bag manipulation in sigstore/timestamp-authority verifier
An authorization bypass vulnerability exists in sigstore/timestamp-authority verifier (timestamp-authority/v2/pkg/verification):
VerifyTimestampResponsefunction correctly verifies the certificate chain but when the TSA specific constraints are verified inVerifyLeafCert, the first non-CA certificate from the PKCS#7 certificate bag is used instead of the leaf certificate from the certificate chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key. The library validates the signature using the one certificate but performs authorization checks on the another, allowing an attacker to bypass some authorization controls.This vulnerability does not apply to timestamp-authority service, only to users of
timestamp-authority/v2/pkg/verificationpackage.This vulnerability does not apply to sigstore-go even though it is a user of
timestamp-authority/v2/pkg/verification: ProvidingTSACertificateoption toVerifyTimestampResponsefully mitigates the issue.Patches
The issue will be fixed in timestamp-authority 2.0.6
Workarounds
Users of
VerifyTimestampResponsecan use theTSACertificateoption to specify the exact certificate they expect to be used: this fully mitigates the issue.References
This issue was found after reading CVE-2026-33753 / GHSA-3xxc-pwj6-jgrj (originally reported by @Jaynornj and @Pr00fOf3xpl0it)
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
CVE-2026-49835 / GHSA-9c54-x2g4-v92j
More information
Details
Impact
An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server.
This vulnerability exists because the global
wrapMetricsmiddleware records the raw HTTP request path (r.URL.Path) and raw HTTP request method (r.Method) as Prometheus labels for latency and request count metric vectors. Since this middleware runs before standard routing occurs, it executes for all incoming requests, including those for unmatched paths (yielding 404 responses) or arbitrary request methods. The Prometheus library registers a new, permanent time-series entry for every distinct label combination. An attacker can continuously issue requests containing random paths (e.g.,/api/v1/timestamp/<uuid>) or random HTTP methods to exhaust system memory.Patches
This issue has been patched by limiting the metric label values to a strict allowlist of expected paths (
/ping,/api/v1/timestamp,/api/v1/timestamp/certchain) and expected HTTP methods (GET,POST,HEAD,OPTIONS). Unrecognized paths or methods are normalized to a static string ("unrecognized").Users should update to version
v2.0.7or later.Workarounds
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sigstore/timestamp-authority (github.com/sigstore/timestamp-authority/v2)
v2.1.0Compare Source
What's Changed
Full Changelog: sigstore/timestamp-authority@v2.0.6...v2.1.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.