Denial Of Service (DOS)

github.com/sigstore/cosign is vulnerable to a Denial of Service DoS. The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: gomplate, rabbitmq-messaging-topology-operator, falcoctl, apko, cosign, dex, k3s, timestamp-authority, flux-kustomize-controller, grpc-health-probe, vexctl, policy-controller, slsa-verifier, sops, wolfictl, fulcio, tkn, step, guac, temporal-ui-server,...

BIT-COSIGN-2022-23649 Improper Certificate Validation in Cosign

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

BIT-COSIGN-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

BIT-COSIGN-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, mc, aws-load-balancer-controller, rclone, envoy-ratelimit, kubewatch, nfs-subdir-external-provisioner, restic, boring-registry, prometheus-alertmanager-fips, secrets-store-csi-driver, kubernetes-dashboard-metrics-scraper,...

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Impact In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise...

Improper Verification Of Cryptographic Signature

github.com/sigstore/gitsign is vulnerable to Improper Verification Of Cryptographic Signature. The vulnerability is applicable in the case where a Rekor server is compromised, as gitsign directly fetches public keys via the API without TUF client validations. This leads to lack of validation and...

CVE-2023-47122

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

Design/Logic Flaw

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

CVE-2023-47122

Gitsign CVE-2023-47122 affects versions 0.6.0 up to 0.7.x (before 0.8.0): Rekor public keys were fetched via the Rekor API instead of the local TUF client, allowing a compromised upstream Rekor server to potentially mislead signature trust. No known compromise of the default Rekor instance (rekor...

CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

GO-2022-0998 Improper blob verification in github.com/sigstore/cosign

Improper blob verification in github.com/sigstore/cosign...

GO-2023-2181 Denial of service attack from remote registry in github.com/sigstore/cosign

An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack...

GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign

Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...