CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: melange, tkn, slsa-verifier, flux-source-controller, apko, skaffold, spire-server, tekton-chains, policy-controller, ko, cosign, kubescape, aactl...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: kubescape, falcoctl-fips, ko, flux-source-controller, apko, aactl, spire-server, tekton-chains, skaffold, melange, slsa-verifier, tkn, cosign, spire-server-fips, policy-controller...

Design/Logic Flaw

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Cosign Resource Management Error Vulnerability

cosign is a container signing, verification and storage in an OCI registry in the United States. A resource management error vulnerability exists in Cosign 2.2.0 and prior versions, which stems from a vulnerability that allows an attacker to take control of the registry and cause a denial of...

CVE-2023-46737: Uncontrolled Resource Consumption

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: smarter-device-manager-fips, vault-csi-provider, conftest-fips, prometheus-adapter-fips, aactl, kiam, prometheus-stackdriver-exporter, metrics-server-fips, up, k3d, timestamp-authority-fips, kubescape, kubeflow, aws-efs-csi-driver-fips, src, cortex, spark-operator,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: k3d, buildkitd, kubeflow, src, slsa-verifier, dgraph, terraform-provider-sendgrid, kubevela, scorecard, up, cortex, kubescape, spark-operator, aactl...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, aactl, aws-load-balancer-controller, cosign, dynamic-localpv-provisioner, nri-prometheus, gke-gcloud-auth-plugin, secrets-store-csi-driver-provider-gcp, nfs-subdir-external-provisioner, aws-efs-csi-driver-fips, flux, runc, zot,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: minio, terraform-provider-sendgrid, kots, dex, pulumi, amass, kubevela, pulumi-language-yaml, kpt, dgraph, kubeflow-katib, stakater-reloader, cue, secrets-store-csi-driver-provider-gcp, pulumi-kubernetes-operator, fuse-overlayfs-snapshotter, mc, nghttp2,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2023:2665-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2665-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding...

SUSE-SU-2023:2665-1 Security update for cosign

This update of cosign fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

PT-2023-36204 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: cosign affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The cosign package has been rebuilt with this security release to address the issue. No information is provided about the...

SUSE CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

SUSE CVE-2022-35929

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...