PT-2024-23124 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: Cosign versions prior to 2.2.4 Description: Cosign provides code signing and transparency for containers and binaries. Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all...

cosign 安全漏洞

cosign is a container signing, verification, and storage in an OCI registry in the United States. A security vulnerability exists in versions prior to cosign 2.2.4 that originates from a maliciously crafted software artifact that may cause a denial of service on a computer running Cosign...

PT-2024-23123 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: Cosign versions prior to 2.2.4 Description: Cosign provides code signing and transparency for containers and binaries. A remote image with a malicious attachment can cause denial of service of the host machine running Cosign, impacting other...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: melange, policy-controller, gomplate, slsa-verifier, temporal, dgraph, ko, dex, kubernetes-dashboard, step-ca, falcoctl, weaviate, spire-server, step, tekton-chains, rekor, terragrunt, zarf, kubescape, skopeo, timestamp-authority, tkn, kargo, flux-source-controller,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: temporal-ui-server, kubernetes-dashboard-fips, timestamp-authority, caddy-fips, gomplate-fips, fulcio, falcoctl, minio, step, argo-workflows, flux-kustomize-controller, dex, kube-rbac-proxy, caddy, vexctl, terragrunt, dgraph, oauth2-proxy, kubescape, nerdctl,...

BIT-COSIGN-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

BIT-COSIGN-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

BIT-COSIGN-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

SUSE-SU-2024:0430-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.3 jscSLE-23879: Bug Fixes: Fix race condition on verification with multiple signatures attached to image 3486 fixclean: Fix clean cmd for private registries 3446 Fixed BYO PKI verification 3427 Features: Allow for option in cosign...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: k8sgpt, crane, aactl, kots, goreleaser, timoni, dagger, skopeo, zot, k3d, docker-machine-driver-harvester, falcoctl, k3s, policy-controller, guac, policy-controller-fips, gitsign, scorecard, eksctl, slsa-verifier, argo-workflows, flux, chartmuseum, cri-tools,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: k8sgpt, crane, aactl, kots, goreleaser, timoni, dagger, skopeo, zot, k3d, docker-machine-driver-harvester, falcoctl, k3s, policy-controller, guac, policy-controller-fips, gitsign, scorecard, eksctl, slsa-verifier, argo-workflows, flux, chartmuseum, cri-tools,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, crossplane-provider-aws-eks, flux-notification-controller, grype, tekton-chains, aactl, gitness, gomplate, goreleaser, zot, crossplane-provider-aws-sns, spire-server-fips, policy-controller, rclone,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2023:4870-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4870-1 advisory. Updated to 2.2.1 jscSLE-23879 - Enhancements: CVE-2023-46737: Possible endless data attack from...

SUSE-SU-2023:4870-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.1 jscSLE-23879 - Enhancements: CVE-2023-46737: Possible endless data attack from attacker-controlled registry bsc1216933 feat: Support basic auth and bearer auth login to registry 3310 add support for ignoring certificates with...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: vexctl, gitsign, kubescape, cosign-fips, falcoctl-fips, falcoctl, tekton-chains...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: tekton-chains, aactl, kots, fulcio, cloudflared, spire-server-fips, gitsign, slsa-verifier, argo-workflows, flux-kustomize-controller, spire-server, dex, sops, timestamp-authority-fips, vexctl, bank-vaults-fips, terragrunt, cosign-fips, cosign, falcoctl-fips,...

CVE-2023-46737

A flaw was found in the cosign package. A attacker with control of a compromised registry or with privileges to make requests to the cluster can create a specific request that will trigger an infinite loop condition, resulting in a denial of service. Mitigation Mitigation for this issue is either...

GO-2022-0998 Improper blob verification in github.com/sigstore/cosign

Improper blob verification in github.com/sigstore/cosign...

GO-2023-2181 Denial of service attack from remote registry in github.com/sigstore/cosign

An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack...

GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign

Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...