Veracode Vulnerability DatabaseVERACODE:46413Denial Of Service (DoS)
4.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%
github.com/sigstore/cosign is vulnerable to a Denial of Service (DoS). The vulnerability is due to reading the attachment from a remote image entirely into memory without checking the size of the attachment first. This flaw allows an attacker to trigger a Denial of Service via a large crafted attachment.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/sigstore/cosign | le | v2.2.3 | |
| github.com/sigstore/cosign | le | v2.2.3 |
References
github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40
github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239
github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e
github.com/sigstore/cosign/releases/tag/v2.2.4
github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc
Related
4.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%