CVE-2024-29903 Cosign vulnerable to machine-wide denial of service via malicious artifacts

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on...

CVE-2024-29903 Cosign vulnerable to machine-wide denial of service via malicious artifacts

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on...

CVE-2024-29902 Cosign vulnerable to system-wide denial of service via malicious attachments

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

CVE-2024-29902 Cosign vulnerable to system-wide denial of service via malicious attachments

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

CVE-2024-29902 Cosign vulnerable to system-wide denial of service via malicious attachments

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

CVE-2024-29902

Affected software: cosign (Cosign) openSUSE/SUSE advisory for cosign 2.2.4. Vulnerability summary: CVE-2024-29902 enables denial of service on the host when processing a remote image with a malicious attachment, caused by reading the attachment entirely into memory without checking its size. Larg...

CVE-2024-29902

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

cosign 安全漏洞

cosign is a container signing, verification and storage in an OCI registry in the United States. A security vulnerability exists in versions prior to cosign 2.2.4 that stems from a remote image with a malicious attachment that could cause a denial of service on a host running Cosign...

cosign 安全漏洞

cosign is a container signing, verification, and storage in an OCI registry in the United States. A security vulnerability exists in versions prior to cosign 2.2.4 that originates from a maliciously crafted software artifact that may cause a denial of service on a computer running Cosign...

PT-2024-23124 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: Cosign versions prior to 2.2.4 Description: Cosign provides code signing and transparency for containers and binaries. Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all...

PT-2024-23123 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: Cosign versions prior to 2.2.4 Description: Cosign provides code signing and transparency for containers and binaries. A remote image with a malicious attachment can cause denial of service of the host machine running Cosign, impacting other...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: kots, cosign, rekor, frp, kubernetes-dashboard, temporal-ui-server, wolfictl, guac, dex, sops, spire-server, sigstore-scaffolding, goreleaser, flux-source-controller, grpc-health-probe, tekton-chains, zarf, minio, rabbitmq-messaging-topology-operator, vexctl,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, argo-workflows, rancher-agent, grpc-health-probe, spire-server, rook, temporal-ui-server-fips, fulcio, minio, bank-vaults-fips, k3s, goreleaser, temporal-fips, argo-workflows-fips, melange, minio-fips, falcoctl-fips, oauth2-proxy,...

BIT-COSIGN-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

BIT-COSIGN-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

BIT-COSIGN-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

SUSE-SU-2024:0430-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.3 jscSLE-23879: Bug Fixes: Fix race condition on verification with multiple signatures attached to image 3486 fixclean: Fix clean cmd for private registries 3446 Fixed BYO PKI verification 3427 Features: Allow for option in cosign...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, newrelic-infrastructure-agent, zot, k9s, cadvisor, cadvisor-fips, timoni, k3d, tekton-chains, up, helm-operator-fips, policy-controller, policy-controller-fips, gitsign, ctop, scorecard, kubeflow-katib, argo-workflows,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: docker-credential-gcr, newrelic-infrastructure-agent, zot, k9s, cadvisor, cadvisor-fips, timoni, k3d, tekton-chains, up, helm-operator-fips, policy-controller, policy-controller-fips, gitsign, ctop, scorecard, kubeflow-katib, argo-workflows,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: spire-server-fips, crossplane-provider-aws-kms, crossplane-provider-aws-cloudformation, crossplane-provider-aws-dynamodb, zot, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront, tekton-chains,...