GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, node-problem-detector, pulumi, kind, cue, src, kubernetes-ingress-defaultbackend, aws-ebs-csi-driver, kubeflow,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, pulumi-language-java, gomplate, kubeflow, src, fuse-overlayfs-snapshotter, nri-prometheus, gitness, pulumi-language-dotnet, certificate-transparency, oauth2-proxy, flux-helm-controller, flux-notification-controller, pulumi, kaf,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2023:2665-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2665-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding...

SUSE-SU-2023:2665-1 Security update for cosign

This update of cosign fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

PT-2023-36204 · Cosign +1 · Cosign +1

Name of the Vulnerable Software and Affected Versions: cosign affected versions not specified Description: The issue is related to a security release in the go 1.20 package. The cosign package has been rebuilt with this security release to address the issue. No information is provided about the...

SUSE CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

SUSE CVE-2022-35929

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

SUSE CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

Low: Red Hat Security Advisory: RHACS 3.73 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

SUSE: Security Advisory (SUSE-SU-2022:3486-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for cosign (SUSE-SU-2022:3486-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2022:3486-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3486-1 advisory. Updated to version 1.12.0 jscSLE-23879: - CVE-2022-36056: Fixed verify-blob could successfully verify an...

SUSE-SU-2022:3486-1 Security update for cosign

This update for cosign fixes the following issues: Updated to version 1.12.0 jscSLE-23879: - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed bsc1203430...

CVE-2022-36056

A vulnerability was found in cosign, where it incorrectly verified an artifact when the embedded rekorBundle does not reference the given signature. This flaw allows an attacker to exploit integrity and confidentiality...

GHSA-8GW7-4J42-W388 Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

Summary A number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. Vulnerability 1: Bundle mismatch causes invalid verification. Summary A cosign bundle can be crafted to successfully verify a blob ev...

Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

Summary A number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. Vulnerability 1: Bundle mismatch causes invalid verification. Summary A cosign bundle can be crafted to successfully verify a blob ev...

Authorization Bypass

github.com/sigstore/cosign is vulnerable to authorization bypasses. A local authenticated attacker is able to use a malicious cosign bundle to successfully verify a blob even if the embedded rekorBundle does not reference the given signature, resulting in immediate validation of invalid...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

Design/Logic Flaw

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...