rekor

Rekor Rekór - “기록Record”을 뜻하는 그리스어 Rekor의 목표는 소프트웨어 프로젝트 공급망 내에서 생성된 메타데이터의 변경 불가능하고 변조 방지 기능을 갖춘 원장ledger을 제공하는 것입니다. Rekor를 통해 소프트웨어 유지보수자와 빌드 시스템은 서명된 메타데이터를 변경 불가능한 기록에 저장할 수 있습니다. 그러면 다른 당사자들이 해당 메타데이터를 조회하여 객체 수명주기의 신뢰와 부인 방지non-repudiation에 대해 정보에 입각한 결정을 내릴 수 있습니다. 자세한 내용은 sigstore 웹사이트를...

CLEANSTART-2026-HZ27786 Security fixes in rekor-backfill-index 1.2.2-r0

Package rekor-backfill-index version 1.2.2-r0 fixes 7 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2024-6104, ghsa-pmwq-pjrm-6p5r, CVE-2026-2303...

CLEANSTART-2026-QY94875 Security fixes in rekor-backfill-index 1.4.3-r0

Package rekor-backfill-index version 1.4.3-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-ME27346 Security fixes in rekor-backfill-index 1.4.3-r1

Package rekor-backfill-index version 1.4.3-r1 fixes 1 vulnerabilities: ghsa-fcv2-xgw5-pqxf...

CLEANSTART-2026-EN93855 Security fixes in rekor-backfill-index 1.4.3-r2

Package rekor-backfill-index version 1.4.3-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, ghsa-mqqf-5wvp-8fh8...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: keda, rekor-fips, juicefs, fluent-bit-plugin-loki, loki, dapr-fips, oauth2-proxy, atlantis, falcosidekick, loki-fips, splunk-otel-collector, gitea-fips, traefik-fips, gitea, opentelemetry-collector-contrib-fips, authservice, kots, splunk-otel-collector-fips,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: cg, gh, ratify, rekor-fips, trivy-fips, ko-fips, cloudbeat, chainctl, buildkitd-fips, crossplane-fips, falcoctl, reports-server, crossplane, aactl, skaffold-fips, tkn-fips, goreleaser, trivy-operator, tekton-chains, cloudbeat-fips, tflint,...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: cg, gh, ratify, rekor-fips, trivy-fips, ko-fips, cloudbeat, chainctl, buildkitd-fips, crossplane-fips, falcoctl, reports-server, crossplane, aactl, skaffold-fips, tkn-fips, goreleaser, trivy-operator, tekton-chains, cloudbeat-fips, tflint,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: gh, melange, trivy-fips, chainctl, falcoctl, aactl, tkn-fips, tekton-chains, gitsign, rekor, tkn, neuvector-sigstore-interface, flux-source-controller, sigstore-scaffolding-fips, slsa-verifier, policy-controller-fips, tekton-chains-fips, sigstore-scaffolding, trivy,...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: rekor, grafana-mimir, cortex, timestamp-authority, fulcio, prometheus-alertmanager...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, cloud-provider-vsphere, containerd, kubernetes-csi-external-attacher, hydra, terraform-provider-google, gitlab-runner, docker-compose, cert-manager-webhook-pdns, k8sgpt, headlamp, juicefs, teleport, cluster-api-azure-controller, litestream,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, grafana-mimir, secrets-store-csi-driver-provider-azure, step-ca, airflow, tekton-chains, zarf, guac, druid, chezmoi, flyte, boring-registry, k8sgpt, argo-workflows, flux, buildkitd, nuclei, velero, zot, rekor, opentelemetry-collector,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: tekton-chains, aactl, vexctl, cloudflared, argo-workflows, slsa-verifier, rekor, kots, oauth2-proxy, cosign, gitsign, kubescape, flux-kustomize-controller, flux-source-controller, spire-server, sops, dex, fulcio, terragrunt, tkn...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tekton-chains, zarf, skaffold, aactl, gh, vexctl, teleport, zot, buildkitd, witness, slsa-verifier, rekor, goreleaser, falcoctl, policy-controller, ratify, docker, trivy-operator, kyverno-notation-aws, cosign, gitsign, sigstore-scaffolding, kubescape,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: snyk-cli, flux-image-reflector-controller, grafana-mimir, step-ca, tekton-chains, zarf, flux-notification-controller, guac, terraform-provider-azurerm, aactl, gh, vexctl, nuclei, crossplane-provider-family-azure, flux, buildkitd, zot,...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...