604 matches found
GO-2024-2719 Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign
Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign...
Denial Of Service (DoS)
github.com/stacklok/minder is vulnerable to a Denial Of Service DoS. The vulnerability is due to the sigstore verifier reading an untrusted response entirely into memory without enforcing a limit on the response body. The vulnerability allows an attacker to crash the Minder server and deny other...
Denial of service of Minder Server from maliciously crafted GitHub attestations
Minder is vulnerable to a denial-of-service DoS attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on th...
CVE-2024-35238
Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service DoS attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that...
CVE-2024-35238
Summary: Minder by Stacklok (pre-0.0.51) is vulnerable to a DoS caused by the sigstore verifier reading an untrusted response without a size limit. An attacker can cause Minder to fetch attestations from a user-controlled GitHub endpoint (orgs/$owner/attestations/$checksumref) and feed a large re...
Denial Of Service (DOS)
github.com/sigstore/cosign is vulnerable to a Denial of Service DoS. The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: oauth2-proxy, goreleaser, grpc-health-probe, temporal-ui-server, weaviate, apko, bank-vaults, falcoctl, frp, k3s, tekton-chains, kubescape, kube-rbac-proxy, nerdctl, skopeo, slsa-verifier, dgraph, gomplate, guac, cosign, step, terragrunt, timestamp-authority,...
BIT-COSIGN-2022-23649 Improper Certificate Validation in Cosign
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...
BIT-COSIGN-2022-36056 Vulnerabilities with blob verification in sigstore cosign
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...
BIT-COSIGN-2023-46737 Possible endless data attack from attacker-controlled registry in cosign
Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: grafana-operator, eksctl, sigstore-scaffolding, kubernetes-dashboard-metrics-scraper, prometheus-mysqld-exporter, kaniko, cri-tools, policy-controller, nats, prometheus-redis-exporter, kubeflow-pipelines, aws-flb-kinesis-fips, crossplane-provider-aws-sns,...
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Impact In certain versions of gitsign, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise...
Improper Verification Of Cryptographic Signature
github.com/sigstore/gitsign is vulnerable to Improper Verification Of Cryptographic Signature. The vulnerability is applicable in the case where a Rekor server is compromised, as gitsign directly fetches public keys via the API without TUF client validations. This leads to lack of validation and...
CVE-2023-47122
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...
Design/Logic Flaw
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...
CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...
CVE-2023-47122
Gitsign CVE-2023-47122 affects versions 0.6.0 up to 0.7.x (before 0.8.0): Rekor public keys were fetched via the Rekor API instead of the local TUF client, allowing a compromised upstream Rekor server to potentially mislead signature trust. No known compromise of the default Rekor instance (rekor...
CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...
CVE-2023-47122 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...