Design/Logic Flaw

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

CVE-2022-23649

Summary: CVE-2022-23649 affects Cosign prior to 1.5.2, where an attacker with pull and push access to an OCI-stored signature can manipulate Cosign to falsely claim a Rekor entry exists. The root cause is improper verification of the Rekor bundle versus the signature during verification; the patc...

CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

A New Tool Wants to Save Open Source from Supply Chain Hacks

Sigstore will make code signing free and easy for software developers, providing an important first line of defense...

4 Major Privacy and Security Updates From Google You Should Know About

Google has announced a number of user-facing and under-the-hood changes in an attempt to boost privacy and security, including rolling out two-factor authentication automatically to all eligible users and bringing iOS-styled privacy labels to Android app listings. "Today we ask people who have...