CVE-2023-47122

Gitsign CVE-2023-47122 affects versions 0.6.0 up to 0.7.x (before 0.8.0): Rekor public keys were fetched via the Rekor API instead of the local TUF client, allowing a compromised upstream Rekor server to potentially mislead signature trust. No known compromise of the default Rekor instance (rekor...

CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

GO-2022-0998 Improper blob verification in github.com/sigstore/cosign

Improper blob verification in github.com/sigstore/cosign...

GO-2023-2181 Denial of service attack from remote registry in github.com/sigstore/cosign

An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack...

GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign

Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, prometheus-node-exporter-fips, kubernetes-ingress-defaultbackend, aactl, fuse-overlayfs-snapshotter, flux-source-controller, terraform, prometheus-pushgateway, stakater-reloader, metrics-server, minio, aws-load-balancer-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kots, kubeflow, slsa-verifier, fuse-overlayfs-snapshotter, pulumi-kubernetes-operator, scorecard, terraform-provider-azurerm, flux-kustomize-controller, kind, terraform, kubescape, grype, kubernetes-csi-livenessprobe, kubewatch, kubevela, gke-gcloud-auth-plugin,...

sigstore-java:BundleFactoryFuzzer: Security exception in com.google.gson.internal.bind.TypeAdapters$28.write

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=4746136236457984 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: BundleFactoryFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash...

sigstore-java:KeysFuzzer: Security exception in org.bouncycastle.asn1.IndefiniteLengthInputStream.read

Project: https://github.com/sigstore/sigstore-java.git Detailed Report: https://oss-fuzz.com/testcase?key=6513515213750272 Project: sigstore-java Fuzzing Engine: libFuzzer Fuzz Target: KeysFuzzer Job Type: libfuzzerasansigstore-java Platform Id: linux Crash Type: Security exception Crash Address:...

sigstore:FuzzComputeDigest: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5611690320592896 Project: sigstore Fuzzing Engine: libFuzzer Fuzz Target: FuzzComputeDigest Job Type: libfuzzerasansigstore Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2022:3486-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3486-1 advisory. Updated to version 1.12.0 jscSLE-23879: - CVE-2022-36056: Fixed verify-blob could successfully verify an...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

Design/Logic Flaw

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign (sigstore) has CVE-2022-36056 affecting verify-blob in versions before 1.12.0. Connected advisories confirm multiple verification bypass issues: (1) a crafted bundle can pass verification even if rekorBundle does not reference the blob; (2) identity flags (certificate email/issuer and GitH...