GO-2022-0326
Improper certificate validation in github.com/sigstore/cosign
At a glance
- Published
- Updated
- CVE
- CVE-2022-23649
- Aliases
- BIT-cosign-2022-23649, GHSA-ccxc-vr6p-4858
Description
Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio certificate authority.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/sigstore/cosign | introduced 0, fixed 1.5.2 |
References
- https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49 FIX
- https://github.com/sigstore/cosign/releases/tag/v1.5.2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |