CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

CVE-2023-46737: Uncontrolled Resource Consumption

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

PT-2023-30177

Name of the Vulnerable Software and Affected Versions Cosign versions prior to 2.2.1 Description The issue is a denial of service vulnerability that can be exploited by an attacker who controls a remote registry. The attacker can return a high number of attestations and/or signatures to Cosign,...