sigstore-java 安全漏洞

sigstore-java is a sigstore open source sigstore java client for interacting with sigstore infrastructure. A security vulnerability exists in sigstore-java that stems from sigstore-java's inability to adequately verify that validly signed but mismatched bundles are included in transparent logs...

GHSA-R4PG-VG54-WXX4 cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

GO-2024-3116 sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go

sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go...

SUSE CVE-2024-45395

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...

Denial Of Service (DoS)

sigstore-go is vulnerable to Denial Of Service DoS. The vulnerability is due to lack of limits on the amount of verifiable data that can be included in a Sigstore Bundle, allowing to consume excessive resource during the verification process...

CVE-2024-45395

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...

sigstore-go has an unbounded loop over untrusted input can lead to endless data attack

Impact sigstore-go is susceptible to a denial of service attack when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these...

GHSA-CQ38-JH5F-37MQ sigstore-go has an unbounded loop over untrusted input can lead to endless data attack

Impact sigstore-go is susceptible to a denial of service attack when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these...

CVE-2024-45395

Sigstore-go versions before 0.6.1 are vulnerable to an Endless data attack when verifying Sigstore Bundles containing large amounts of verifiable data (signed transparency log entries, RFC 3161 timestamps, attestation subjects). The issue causes high CPU usage and can disrupt verification process...

CVE-2024-45395 Unbounded loop over untrusted input can lead to endless data attack

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...

CVE-2024-45395 Unbounded loop over untrusted input can lead to endless data attack

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...

CVE-2024-45395 Unbounded loop over untrusted input can lead to endless data attack

sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, R...

sigstore-go 安全漏洞

sigstore-go is a client library for Sigstore from the sigstore open source. A security vulnerability exists in sigstore-go versions prior to 0.6.1, which stems from the processing of maliciously constructed Sigstore Bundles containing massively verifiable data that can lead to excessive CPU...

GO-2022-0759 PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller

PolicyController before 0.2.1 may bypass attestation verification in github.com/sigstore/policy-controller...

GO-2023-2332 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign

Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign...

GO-2023-1754 Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor

Rekor's compressed archives can result in OOM conditions in github.com/sigstore/rekor...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: py3-azure-identity, goreleaser, harbor-registry, grafana-mimir, bank-vaults, opentelemetry-collector-contrib, py3-cassandra-medusa, falcoctl, up, tekton-chains, sqlpad, kubescape, buildkitd, tempo, trino, grafana-agent-operator, thanos, guac, cosign, step, terragrunt...