484 matches found
CVE-2022-23649
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...
CVE-2022-23649
Summary: CVE-2022-23649 affects Cosign prior to 1.5.2, where an attacker with pull and push access to an OCI-stored signature can manipulate Cosign to falsely claim a Rekor entry exists. The root cause is improper verification of the Rekor bundle versus the signature during verification; the patc...
CVE-2022-23649 Improper Certificate Validation in Cosign
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...
Cosign 信任管理问题漏洞
Cosign is a container signature, verification and storage in the Oci registry in the U.S. Versions prior to Cosign 1.5.2 are vulnerable to trust management issues, which can be exploited by attackers to access signatures in the OCI and manipulate cosign...
CVE-2022-23649: Improper Certificate Validation
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...
PT-2022-16159
Name of the Vulnerable Software and Affected Versions Cosign versions prior to 1.5.2 Description The issue allows an attacker to manipulate Cosign into claiming that a signature exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions...
cosign:fuzz_getPassword: Crash in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5039668471660544 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001688 Crash State: pthreadcreate cgotrypthreadcreate...
cosign:fuzz_getPassword: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=6396103086964736 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...
cosign:fuzz_getPassword: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=5212354219474944 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...
4 Major Privacy and Security Updates From Google You Should Know About
Google has announced a number of user-facing and under-the-hood changes in an attempt to boost privacy and security, including rolling out two-factor authentication automatically to all eligible users and bringing iOS-styled privacy labels to Android app listings. "Today we ask people who have...
Cosign 2.0.1/2.9.4a CGI Register Command Remote Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/23424/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An authenticated attacker can exploit this issue to access services hoste...
SA-CONTRIB-2011-022 - Cosign - SQL Injection
Under certain conditions the module deletes uid 1 and then does an unparameterized dbquery to insert a new uid 1. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site configuration" and must be able to remotely manipulate the web serve...
CVE-2007-2232
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...
Authentication flaw
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...
Command injection
cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR \r sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username...
CVE-2007-2232
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...
CVE-2007-2232
CVE-2007-2232 concerns the Cosign vulnerability where the CHECK command in Cosign 2.0.1 and earlier can be abused to bypass authentication through CR (\r) sequences in the cosign cookie parameter. Affected software is Cosign up to version 2.0.1 and earlier; the underlying issue is improper handli...
CVE-2007-2233
Cosign 2.0.2 and earlier (cosign-bin/cosign.cgi) are affected. The issue allows remote authenticated users to perform unauthorized actions as an arbitrary user by injecting LOGIN and REGISTER commands via CR (\r) sequences in the service parameter. Root cause is input handling that does not neutr...
CVE-2007-2233: Undefined Security Weakness
cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR \r sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username...
CVE-2007-2232: Undefined Security Weakness
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...