openSUSE Security Advisory (SUSE-SU-2024:1486-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cosign: Malicious artifects can cause machine-wide denial of service

A flaw was found in the Cosign package where maliciously crafted software artifacts can trigger uncontrolled resource consumption by allocating too much memory and starving out the system. A successful attack may result in a denial of service of the machine running Cosign, impacting availability...

cosign: Malicious attachments can cause system-wide denial of service

A flaw was found in the Cosign package where a malicious attachment may trigger uncontrolled resource consumption by allocating too much memory. This flaw allows an attacker to craft a malicious attachment, resulting in a denial of service, possibly impacting other applications running on the sam...

SUSE-SU-2024:1486-2 Security update for cosign

This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...

OPENSUSE-SU-2024:12331-1 cosign-1.12.0-1.1 on GA media

These are all security issues fixed in the cosign-1.12.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13402-1 cosign-2.2.1-1.1 on GA media

These are all security issues fixed in the cosign-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11860-1 cosign-1.5.2-1.1 on GA media

These are all security issues fixed in the cosign-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13646-1 cosign-2.2.3-1.1 on GA media

These are all security issues fixed in the cosign-2.2.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13863-1 cosign-2.2.4-1.1 on GA media

These are all security issues fixed in the cosign-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12240-1 cosign-1.10.1-1.1 on GA media

These are all security issues fixed in the cosign-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: hugo, buildkitd, wal-g, secrets-store-csi-driver-provider-azure, zot, restic, ksops, zarf, py3-cassandra-medusa, k8sgpt, pulumi, druid, harbor-registry, hugo-extended, flux-source-controller, grafana-agent-operator, velero, flux-image-reflector-controller, nuclei,...

GO-2024-2719 Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign...

GO-2024-2718 Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign

Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign...

SUSE-SU-2024:1486-1 Security update for cosign

This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...

SUSE CVE-2024-29903

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on...

SUSE CVE-2024-29902

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

Denial Of Service (DOS)

github.com/sigstore/cosign is vulnerable to a Denial of Service DoS. The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via...

BIT-COSIGN-2024-29902 Cosign vulnerable to system-wide denial of service via malicious attachments

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as ...

BIT-COSIGN-2024-29903 Cosign vulnerable to machine-wide denial of service via malicious artifacts

Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on...

GHSA-95PR-FXF5-86GV Cosign malicious artifacts can cause machine-wide DoS

Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted...