308 matches found
CVE-2026-24122
Cosign
CVE-2026-24122
Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...
CVE-2026-24122 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked
Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper validation of certificate chains during signature verification when transparency log verification is skipped. An attacker can cause acceptance of signatures with expired intermediate...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper validation of certificate chains during signature verification when transparency log verification is skipped. An attacker can cause acceptance of signatures with expired intermediate...
GHSA-WFQV-66VQ-46RM Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...
PT-2026-20949
Name of the Vulnerable Software and Affected Versions Cosign versions 3.0.4 and below Description Cosign is a tool that provides code signing and transparency for containers and binaries. A flaw in the certificate validation process allows expired intermediate Certificate Authorities to validate...
cosign 信任管理问题漏洞
Cosign is a container signature, verification, and storage mechanism in the OCI registry of the United States. Versions of Cosign prior to 3.0.4 contained a trust management vulnerability. This vulnerability stemmed from issues with the certificate verification logic, potentially causing the...
Medium: runfinch-finch
Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...
Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1420)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1420 advisory. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. CVE-2025-47913 net/http: memory exhaustion in...
Medium: runfinch-finch
Issue Overview: SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. CVE-2025-47913 net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives...
OPENSUSE-RU-2026:20161-1 Recommended update for hauler
This update for hauler fixes the following issues: Changes in hauler: - Update to version 1.4.1 bsc1256546, CVE-2026-22772: fixed typos for containerd imports 493 fix and support containerd imports of hauls 492 bump github.com/sigstore/fulcio 489 - Update to version 1.4.0: added/updated logging f...
CVE-2026-22772 vulnerabilities
Vulnerabilities for packages: tekton-chains, sigstore-scaffolding, zarf, falcoctl, aactl, slsa-verifier, kots, vexctl, gitsign, falco-no-driver, kubescape, skopeo, witness, cosign...
GHSA-59JP-PJ84-45MR vulnerabilities
Vulnerabilities for packages: tekton-chains, sigstore-scaffolding, zarf, falcoctl, aactl, slsa-verifier, kots, vexctl, gitsign, falco-no-driver, kubescape, skopeo, witness, cosign...
GHSA-59JP-PJ84-45MR vulnerabilities
Vulnerabilities for packages: skopeo, kyverno-policy-reporter-plugins-kyverno-fips, sigstore-scaffolding, kyverno, tekton-chains, chainctl, aactl, image-factory, sigstore-scaffolding-fips, kyverno-fips, zarf, kubescape, gitsign, slsa-verifier, kots, podman-fips, flux-source-controller-fips,...
CVE-2026-22772 vulnerabilities
Vulnerabilities for packages: skopeo, kyverno-policy-reporter-plugins-kyverno-fips, sigstore-scaffolding, kyverno, tekton-chains, chainctl, aactl, image-factory, sigstore-scaffolding-fips, kyverno-fips, zarf, kubescape, gitsign, slsa-verifier, kots, podman-fips, flux-source-controller-fips,...
CVE-2026-22703
Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...
GO-2026-4309 Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign...
