Skip to content
OpenAdvisories

Package · Alpine

cosign

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2023-46737

    Possible endless data attack from attacker-controlled registry in cosign

    Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Co…

    sigstore cosign github.com/sigstore/cosign github.com/sigstore/cosign/v2 Alpine Go
  • Low 3.3
    CVE-2022-23649

    Improper Certificate Validation in Cosign

    Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This re…

    sigstore cosign github.com/sigstore/cosign cosign Alpine Go