github.com/sigstore/cosign/v3
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Cosign's verify-blob-attestation reports false positive when payload parsing fails | github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 | GoRed Hat | Medium | Fix reported | |
| Cosign verification accepts any valid Rekor entry under certain conditions | github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 | GoRed Hat | Medium | Fix reported | |
| Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped | github.com/sigstore/cosign/v2github.com/sigstore/cosign/v3 | Go | Low | Fix reported |