Sigstore Cosign Bypass Security Restrictions

The vulnerability in the cosign verify-blob and cosign verify-blob-attestation commands of the Sigstore Cosign digital signature tool is related to errors in the certificate verification process, allowing a remote attacker to bypass security restrictions...

PT-2026-135975

Уязвимость команд cosign verify-blob и cosign verify-blob-attestation инструмента для цифровой подписи Sigstore Cosign, связана с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю, действующему удаленно, обойти ограничения безопасности...

GO-2026-4529 Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign

Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign...

GO-2024-2719 Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign

Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign...

Denial Of Service (DOS)

github.com/sigstore/cosign is vulnerable to a Denial of Service DoS. The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...