GHSA-8GW7-4J42-W388 Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

Summary A number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. Vulnerability 1: Bundle mismatch causes invalid verification. Summary A cosign bundle can be crafted to successfully verify a blob ev...