GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign

Improper verification of signature attestations in github.com/sigstore/cosign...

GHSA-VFP6-JRW2-99G9 Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: tekton-chains, melange, slsa-verifier, tkn, aactl, kubescape, apko, skaffold, ko, policy-controller, spire-server-fips, cosign, falcoctl-fips, spire-server, flux-source-controller...

Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: melange, flux-source-controller, policy-controller, slsa-verifier, aactl, spire-server, skaffold, ko, tekton-chains, apko, kubescape, cosign, tkn...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...

SUSE CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: melange, flux-source-controller, policy-controller, slsa-verifier, aactl, spire-server, skaffold, ko, tekton-chains, apko, kubescape, cosign, tkn...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: tekton-chains, melange, slsa-verifier, tkn, aactl, kubescape, apko, skaffold, ko, policy-controller, spire-server-fips, cosign, falcoctl-fips, spire-server, flux-source-controller...

Design/Logic Flaw

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Cosign Resource Management Error Vulnerability

cosign is a container signing, verification and storage in an OCI registry in the United States. A resource management error vulnerability exists in Cosign 2.2.0 and prior versions, which stems from a vulnerability that allows an attacker to take control of the registry and cause a denial of...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, terraform-provider-sendgrid, k3d, volume-modifier-for-k8s-fips, prometheus-blackbox-exporter, kubernetes-csi-livenessprobe-fips, scorecard, aws-efs-csi-driver-fips, slsa-verifier, spark-operator, up, kiam, prometheus-stackdriver-exporter,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-blackbox-exporter, terraform-provider-sendgrid, kubevela, buildkitd, cortex, scorecard, k3d, aactl, slsa-verifier, up, dgraph, kubeflow, spark-operator, src, kubescape...