Denial Of Service (DOS)

github.com/sigstore/cosign is vulnerable to a Denial of Service DoS. The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via...

Denial Of Service

github.com/sigstore/cosign is vulnerable to Denial Of Service DoS. The vulnerability arises due to a lack of validation of "l" slice in the FetchAttestations method. An attacker who controls a remote registry can return huge number of attestations to cosign and cause cosign to enter into an endle...