CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Cosign Resource Management Error Vulnerability

cosign is a container signing, verification and storage in an OCI registry in the United States. A resource management error vulnerability exists in Cosign 2.2.0 and prior versions, which stems from a vulnerability that allows an attacker to take control of the registry and cause a denial of...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, kubernetes-csi-livenessprobe, k3d, dynamic-localpv-provisioner-fips, up, kiam, kubeflow-fips, prometheus-stackdriver-exporter, scorecard, metrics-server-fips, kubevela, aactl, volume-modifier-for-k8s-fips, prometheus-blackbox-exporter,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, up, kubeflow, dgraph, aactl, buildkitd, kubevela, k3d, slsa-verifier, src, cortex, spark-operator, scorecard, kubescape...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, prometheus-mongodb-exporter-fips, prometheus-mongodb-exporter, kiam, flux-kustomize-controller, prometheus-statsd-exporter, aws-ebs-csi-driver, metrics-server-fips, prometheus-adapter, nfs-subdir-external-provisioner,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, grype, k3d, terraform-provider-azurerm, ip-masq-agent, secrets-store-csi-driver, gobuster, kubevela, cue, gitness, envoy-ratelimit, bom, fuse-overlayfs-snapshotter, memcached-exporter, kubewatch, terraform-provider-aws, haproxy-ingress,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2023:2665-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2665-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding...

SUSE-SU-2023:2665-1 Security update for cosign

This update of cosign fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

PT-2023-36204 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: cosign affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The cosign package has been rebuilt with this security release to address the issue. No information is provided about the...

SUSE CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

SUSE CVE-2022-35929

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

SUSE CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

Low: Red Hat Security Advisory: RHACS 3.73 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

SUSE: Security Advisory (SUSE-SU-2022:3486-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for cosign (SUSE-SU-2022:3486-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2022:3486-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3486-1 advisory. Updated to version 1.12.0 jscSLE-23879: - CVE-2022-36056: Fixed verify-blob could successfully verify an...