GitHub ‘Verified’ Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
What Happened — Researchers demonstrated that an attacker who does not possess the original signing key can craft a new Git commit that contains the same files, author, and timestamp as a legitimate “Verified” commit, generate a valid GPG signature, and have GitHub still display the “Verified” badge. The new commit has a different SHA‑1 hash, meaning the hash no longer guarantees immutability.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Change Management) requires immutable, verifiable evidence of code changes; a mutable hash defeats that guarantee.
- Continuous‑compliance programs depend on cryptographic proof to build a defensible audit trail—this flaw creates a blind spot in your control evidence.
- Verisq’s Control Mapping capability lets you map this gap to the relevant SOC 2 controls and collect independent proof of commit provenance for audit readiness.
Who Is Affected — Software development teams, CI/CD pipelines, SaaS providers, and any organization that relies on GitHub’s “Verified” badge for code‑integrity assurance, especially those subject to SOC 2 audits.
Recommended Actions
- Augment GitHub’s native verification with internal hash‑validation scripts or signed tags that include the commit hash in the signed payload.
- Document the additional verification step as part of your change‑management controls and capture the logs as audit evidence.
- Subscribe to GitHub security advisories and apply any patches that address this verification weakness promptly.
- Incorporate continuous monitoring of commit integrity into your SOC 2 evidence collection workflow.
Source: The Hacker News
Technical Notes
- Attack Vector: Exploits a design limitation in Git’s commit‑signing model; the signature validates the commit content but not the hash itself.
- Impact Scope: Potential exposure of code‑integrity guarantees; no known CVE assigned yet, but the issue is publicly disclosed.
- Data Types Affected: Source‑code files, commit metadata, GPG signatures.
Source: same as above