Veracode Vulnerability DatabaseVERACODE:46414Denial Of Service (DOS)
4.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
4.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%
github.com/sigstore/cosign is vulnerable to a Denial of Service (DoS). The vulnerability is due to allocating excessive memory when creating slices based on the number of signatures, manifests, or attestations in untrusted artifacts. This flaw allows an attacker to trigger a Denial of Service via submitting a crafted artifact with an inflated number of signatures or manifests.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/sigstore/cosign | le | v2.2.3 | |
| github.com/sigstore/cosign | le | v2.2.3 |
References
github.com/advisories/GHSA-95pr-fxf5-86gv
github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955
github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70
github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e
github.com/sigstore/cosign/pull/3661
github.com/sigstore/cosign/releases/tag/v2.2.4
github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv
Related
4.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
4.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%