CVE-2024-54140 — sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a bundle provides a invalid signature for a chec — CVE Database · The Intelligence Room