Threats affecting pkg:cargo/sequoia-git

sequoia-git versions prior to 0.6.0 contain a vulnerability in hard revocation handling due to a bug that causes the policy hash to be truncated to zero bytes. This results in only hard revocations present in the target commit being considered, ignoring previously seen revocations. An attacker with access to a compromised key can exploit this by submitting a merge request that removes a hard revocation from the signing policy. If merged, subsequent commits will not be properly authenticated against that revocation. Successful exploitation requires tricking a maintainer into merging the malicious request.

Sequoia git (sq-git) versions before 0.6.0 contain a vulnerability in hard revocation handling due to a bug where policy hashes are truncated to zero bytes. This causes sq-git to only consider hard revocations present in the target commit, ignoring those in the project's signing policy. An attacker with access to a compromised key can exploit this by submitting a merge request that removes a hard revocation from the policy. If merged, subsequent commits will not be properly authenticated against the revoked key. Successful exploitation requires tricking a project maintainer into merging the malicious request.