9 matches found
CVE-2023-46737
CVE-2023-46737 affects Cosign, a sigstore signing tool for OCI containers. The root cause is that Cosign loops through all attestations fetched from a remote registry in pkg/cosign.FetchAttestations, allowing an attacker-controlled registry to return a high number of attestations or signatures an...
CVE-2024-29902
Affected software: cosign (Cosign) openSUSE/SUSE advisory for cosign 2.2.4. Vulnerability summary: CVE-2024-29902 enables denial of service on the host when processing a remote image with a malicious attachment, caused by reading the attachment entirely into memory without checking its size. Larg...
CVE-2024-29903
CVE-2024-29903 affects Cosign before version 2.2.4. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts, allowing an artifact to force excessive memory allocation and cause a machine‑wide DoS. The issue is specifically t...
CVE-2022-23649
Summary: CVE-2022-23649 affects Cosign prior to 1.5.2, where an attacker with pull and push access to an OCI-stored signature can manipulate Cosign to falsely claim a Rekor entry exists. The root cause is improper verification of the Rekor bundle versus the signature during verification; the patc...
CVE-2022-35929
CVE-2022-35929 affects cosign prior to version 1.10.1. In cosign verify-attestation, using --type (default: custom) can yield a false positive when there is at least one attestation with a valid signature and no attestations of the type being verified. Repro example uses distroless image with a v...
CVE-2022-36056
Cosign (sigstore) has CVE-2022-36056 affecting verify-blob in versions before 1.12.0. Connected advisories confirm multiple verification bypass issues: (1) a crafted bundle can pass verification even if rekorBundle does not reference the blob; (2) identity flags (certificate email/issuer and GitH...
CVE-2026-39395
CVE-2026-39395 affects Cosign prior to 3.0.6 and 2.6.3, where verify-blob-attestation could erroneously report a Verified OK result for attestations with malformed payloads or mismatched predicate types. The root causes differ by bundle format: old-format bundles had a logic flaw in error handlin...
CVE-2026-22703
Cosign prior to versions 2.6.2 and 3.0.4 could verify a Rekor entry without actually checking the artifact digest, signature, or public key, allowing a malicious actor to craft a valid bundle from any Rekor entry and evade audit. The issue affects Cosign’s signing/verification workflow and could ...