Security
فارسی
All products

github.com/sigstore/cosign

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Cosign's verify-blob-attestation reports false positive when payload parsing failsCVE-2026-39395 · GHSA-W6C6-C85G-MMV6Version ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 GoRed Hat Medium Fix reported
Cosign verification accepts any valid Rekor entry under certain conditionsCVE-2026-22703 · GHSA-WHQX-F9J3-CH6MVersion ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 GoRed Hat Medium Fix reported
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skippedCVE-2026-24122 · GHSA-WFQV-66VQ-46RMVersion ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 Go Low Fix reported
Cosign vulnerable to possible endless data attack from attacker-controlled registryCVE-2023-46737 · GHSA-VFP6-JRW2-99G9Version ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign GoRed Hat Low Fix reported
Cosign malicious attachments can cause system-wide denial of serviceCVE-2024-29902 · GHSA-88JX-383Q-W4QCVersion ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign Go Medium Fix reported
Cosign malicious artifacts can cause machine-wide DoSCVE-2024-29903 · GHSA-95PR-FXF5-86GVVersion ranges need review. github.com/sigstore/cosign/v2github.com/sigstore/cosign Go Medium Fix reported
Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signatureCVE-2022-36056 · GHSA-8GW7-4J42-W388Version ranges need review. github.com/sigstore/cosignOpenShift Serverless/openshift-serverless-1/client-kn-rhel8 GoRed Hat Medium Fix reported
Improper Certificate Validation in CosignCVE-2022-23649 · GHSA-CCXC-VR6P-4858Version ranges need review. github.com/sigstore/cosign Go Low Fix reported
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation existsCVE-2022-35929 · GHSA-VJXV-45G9-9296Version ranges need review. github.com/sigstore/cosignOpenShift Serverless/openshift-serverless-1/client-kn-rhel8 GoRed Hat High Fix reported