GHSA-8GW7-4J42-W388 Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

Summary A number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. Vulnerability 1: Bundle mismatch causes invalid verification. Summary A cosign bundle can be crafted to successfully verify a blob ev...

PT-2022-23147

Name of the Vulnerable Software and Affected Versions cosign versions prior to 1.12.0 Description A number of issues have been found in cosign verify-blob, where cosign would successfully verify an artifact when verification should have failed. These issues include: - a cosign bundle can be craft...