As cited
Copy frozen at (site build).
vulnerabilities
GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
Researchers discovered that signed Git commits can be rewritten to produce different hashes while maintaining valid signatures that GitHub still verifies as legitimate. An attacker without the signing key can create a duplicate commit with identical files, author, and date information, yet a different hash value, and GitHub's verification will still pass.
Why it matters: Development teams relying on commit verification as a supply chain control are at risk of accepting malicious code that appears legitimately signed; practitioners should review their Git security practices and commit verification workflows to account for this hash collision issue.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
Researchers discovered that signed Git commits can be rewritten to produce different hashes while maintaining valid signatures that GitHub still verifies as legitimate. An attacker without the signing key can create a duplicate commit with identical files, author, and date information, yet a different hash value, and GitHub's verification will still pass.
Why it matters: Development teams relying on commit verification as a supply chain control are at risk of accepting malicious code that appears legitimately signed; practitioners should review their Git security practices and commit verification workflows to account for this hash collision issue.
- Source published
- First seen by Cybersecurity Tracker