PT-2025-49168

Name of the Vulnerable Software and Affected Versions Fulcio versions prior to 1.8.3 Description Fulcio is a certificate authority for issuing code signing certificates for OpenID Connect OIDC identity. The identity.extractIssuerURL function splits its input, which is untrusted data, on periods. ...

CVE-2024-53267

sigstore-java (the Java client) is affected by a vulnerability where KeylessVerifier.verify() may accept a validly-signed but mismatched bundle as proof of inclusion in a transparency log. The log-entry could be unrelated to the artifact, allowing a bundle to appear logged without proof the signi...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

sigstore-java has vulnerability with bundle verification

Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify The verifier may accept a bundle with an...

SUSE-SU-2024:1486-2 Security update for cosign

This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: sqlpad, fulcio, buildkitd, terragrunt, trivy, flux-image-reflector-controller, rekor, argo-workflows, flux, chezmoi, goreleaser, tkn, nuclei, harbor-registry, cortex, hugo-extended, argo-events, falcoctl, kubescape, step-ca, external-dns, pulumi, tekton-chains,...

SUSE-SU-2024:1486-1 Security update for cosign

This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: fulcio, melange, skaffold, kube-rbac-proxy, grpc-health-probe, terragrunt, oauth2-proxy, weaviate, rekor, argo-workflows, goreleaser, kots, tkn, kargo, rabbitmq-messaging-topology-operator, gomplate, dex, dgraph, ko, nerdctl, minio, falcoctl, caddy, apko, kubescape,...

GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign

Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...

SUSE CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

GHSA-VJXV-45G9-9296 cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists

cosign verify-attestation used with the --type flag will report a false positive verification when: - There is at least one attestation with a valid signature - There are NO attestations of the type being verified --type defaults to "custom" This can happen when signing with a standard keypair an...

CVE-2022-35929

A flaw was found in the cosign package. The cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and when there are no attestations of the type being verified for example, —type defaults to...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...