Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/cosign

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2022-35929

    False positive signature verification in cosign

    cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is a…

    sigstore cosign github.com/sigstore/cosign cosign Alpine Go