Multiple Vulnerabilities in GoSign Desktop lead to Remote Code Execution

This advisory reports critical vulnerabilities in GoSign Desktop 2.4.0: TLS certificate validation is disabled when a proxy is configured and the update mechanism relies on an unsigned manifest, enabling MitM attacks that can deliver malicious updates and achieve remote code execution and credential exfiltration; a PoC and technical details were published, a CVSS 3.1 score of 8.2 was assigned, and a partial fix (2.4.1) was released which reportedly does not restore TLS validation when a proxy is used.