GitHub Verified Commits Vulnerability Allows Hash Malleability Without Signature Compromise

A vulnerability in GitHub's 'Verified' commits allows attackers to rewrite commit hashes without invalidating signatures, undermining systems that rely on hash uniqueness for security. The flaw exploits signature malleability across GPG, RSA, EdDSA, and S/MIME schemes, requiring forge-side fixes to canonicalize signatures.

New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without the signing key can mint a second commit with the same files, author, and date, and a valid signature, GitHub still stamps "Verified."

Everything a reviewer would check matches. The commit's hash does not. That matters

Read original article