SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2023:4870-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4870-1 advisory. Updated to 2.2.1 jscSLE-23879 - Enhancements: CVE-2023-46737: Possible endless data attack from...

SUSE-SU-2023:4870-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.1 jscSLE-23879 - Enhancements: CVE-2023-46737: Possible endless data attack from attacker-controlled registry bsc1216933 feat: Support basic auth and bearer auth login to registry 3310 add support for ignoring certificates with...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, falcoctl, kubescape, cosign-fips, vexctl, gitsign, tekton-chains...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, sops, kots, kubescape, fulcio-fips, spire-server, cosign-fips, spire-server-fips, flux-source-controller, terragrunt, timestamp-authority-fips, argo-workflows, flux-kustomize-controller, dex, vexctl, bank-vaults-fips, oauth2-proxy, tkn,...

CVE-2023-46737

A flaw was found in the cosign package. A attacker with control of a compromised registry or with privileges to make requests to the cluster can create a specific request that will trigger an infinite loop condition, resulting in a denial of service. Mitigation Mitigation for this issue is either...

GO-2022-0998 Improper blob verification in github.com/sigstore/cosign

Improper blob verification in github.com/sigstore/cosign...

GO-2023-2181 Denial of service attack from remote registry in github.com/sigstore/cosign

An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack...

GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign

Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...

GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign

Improper verification of signature attestations in github.com/sigstore/cosign...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, apko, tkn, spire-server, skaffold, aactl, kubescape, policy-controller, ko, melange, flux-source-controller, spire-server-fips, tekton-chains, cosign...

GHSA-VFP6-JRW2-99G9 Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: cosign, melange, tekton-chains, flux-source-controller, slsa-verifier, spire-server, kubescape, policy-controller, apko, ko, skaffold, aactl, tkn...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...

SUSE CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: cosign, melange, tekton-chains, flux-source-controller, slsa-verifier, spire-server, kubescape, policy-controller, apko, ko, skaffold, aactl, tkn...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, apko, tkn, spire-server, skaffold, aactl, kubescape, policy-controller, ko, melange, flux-source-controller, spire-server-fips, tekton-chains, cosign...

Design/Logic Flaw

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...