GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign

Improper verification of signature attestations in github.com/sigstore/cosign...

GHSA-VFP6-JRW2-99G9 Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: spire-server, policy-controller, apko, ko, melange, flux-source-controller, kubescape, spire-server-fips, slsa-verifier, skaffold, tkn, falcoctl-fips, cosign, aactl, tekton-chains...

Cosign vulnerable to possible endless data attack from attacker-controlled registry

Summary Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is tha...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: tekton-chains, melange, tkn, aactl, slsa-verifier, flux-source-controller, policy-controller, skaffold, ko, spire-server, apko, kubescape, cosign...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...

SUSE CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: tekton-chains, melange, tkn, aactl, slsa-verifier, flux-source-controller, policy-controller, skaffold, ko, spire-server, apko, kubescape, cosign...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: spire-server, policy-controller, apko, ko, melange, flux-source-controller, kubescape, spire-server-fips, slsa-verifier, skaffold, tkn, falcoctl-fips, cosign, aactl, tekton-chains...

Design/Logic Flaw

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737 Possible endless data attack from attacker-controlled registry in cosign

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

Cosign Resource Management Error Vulnerability

cosign is a container signing, verification and storage in an OCI registry in the United States. A resource management error vulnerability exists in Cosign 2.2.0 and prior versions, which stems from a vulnerability that allows an attacker to take control of the registry and cause a denial of...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow-fips, terraform-provider-sendgrid, up, bank-vaults-fips, src, buildkitd, kubernetes-csi-livenessprobe, kubeflow, terraform-provider-sendgrid-fips, volume-modifier-for-k8s-fips, aactl, timestamp-authority-fips, smarter-device-manager-fips, scorecard,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, k3d, buildkitd, aactl, slsa-verifier, up, spark-operator, kubeflow, prometheus-blackbox-exporter, dgraph, cortex, kubevela, src, kubescape, scorecard...