https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 10:27:48 +0000 https://cve.radiocsirt.org/vuln/bit-cosign-2022-36056 <p><strong>Affected:</strong> Bitnami: cosign</p> <p>Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.</p> <p><strong>Affected:</strong> Bitnami: cosign</p> <p>Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.</p> https://cve.radiocsirt.org/vuln/bit-cosign-2022-36056 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/cleanstart-2026-oh46796 <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-oh46796 https://cve.radiocsirt.org/vuln/euvd-2026-232616 EUVD-2026-232616 https://cve.radiocsirt.org/vuln/euvd-2026-232616 https://cve.radiocsirt.org/vuln/fkie_cve-2022-36056 <p>Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.</p> <p>Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-36056 https://cve.radiocsirt.org/vuln/ghsa-8gw7-4j42-w388 <p><strong>Affected:</strong> Go: github.com/sigstore/cosign</p> <p>## Summary</p> <p>A number of vulnerabilities have been found in `cosign verify-blob`, where Cosign would successfully verify an artifact when verification should have failed.</p> <p>## Vulnerability 1: Bundle mismatch causes invalid verification.</p> <p>### Summary A cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature.</p> <p>### Details Cosign supports &#34;bundles&#34; which intend to allow offline verification of the signature and rekor inclusion. By using the --bundle flag in cosign sign-blob, cosign will create a JSON file called a &#34;bundle&#34;. These bundles include three fields: base64Signature, cert, and rekorBundle. The desired behavior is that the verification of these bundles would:</p> <p>- verify the provided blob using the included signature and certificate - verify the rekorBundle SET - verify the rekorBundle payload references the given artifact.</p> <p>It appears that step three is not being performed, allowing &#34;any old rekorBundle&#34; to pass validation, even if the rekorBundle payload does not reference the provided blob or the certificate and signature in the rekorBundle do not match those at the top level.</p> <p>### Steps to reproduce Enable keyless signing:</p> <p>``` export COSIGN_EXPERIMENTAL=1 ``` Create two random blobs: ``` dd bs=1 count=50 &lt;/dev/urandom &gt;blob1 dd bs=1 count=50 &lt;/dev/urandom &gt;blob2 ``` Sign each blob: ``` cosign sign-blob blob1 --bundle bundle1 cosign sign-blob blob2 --bundle bundle2 ``` Create a falsified bundle…</p> <p><strong>Affected:</strong> Go: github.com/sigstore/cosign</p> <p>## Summary</p> <p>A number of vulnerabilities have been found in `cosign verify-blob`, where Cosign would successfully verify an artifact when verification should have failed.</p> <p>## Vulnerability 1: Bundle mismatch causes invalid verification.</p> <p>### Summary A cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature.</p> <p>### Details Cosign supports &#34;bundles&#34; which intend to allow offline verification of the signature and rekor inclusion. By using the --bundle flag in cosign sign-blob, cosign will create a JSON file called a &#34;bundle&#34;. These bundles include three fields: base64Signature, cert, and rekorBundle. The desired behavior is that the verification of these bundles would:</p> <p>- verify the provided blob using the included signature and certificate - verify the rekorBundle SET - verify the rekorBundle payload references the given artifact.</p> <p>It appears that step three is not being performed, allowing &#34;any old rekorBundle&#34; to pass validation, even if the rekorBundle payload does not reference the provided blob or the certificate and signature in the rekorBundle do not match those at the top level.</p> <p>### Steps to reproduce Enable keyless signing:</p> <p>``` export COSIGN_EXPERIMENTAL=1 ``` Create two random blobs: ``` dd bs=1 count=50 &lt;/dev/urandom &gt;blob1 dd bs=1 count=50 &lt;/dev/urandom &gt;blob2 ``` Sign each blob: ``` cosign sign-blob blob1 --bundle bundle1 cosign sign-blob blob2 --bundle bundle2 ``` Create a falsified bundle…</p> https://cve.radiocsirt.org/vuln/ghsa-8gw7-4j42-w388 https://cve.radiocsirt.org/vuln/gsd-2022-36056 gsd-2022-36056 https://cve.radiocsirt.org/vuln/gsd-2022-36056 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12331-1 <p>cosign-1.12.0-1.1 on GA media</p> <p>cosign-1.12.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12331-1 https://cve.radiocsirt.org/vuln/rhsa-2022:8827 <p>imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path app-containers/cosign: false positive verification</p> <p>imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path app-containers/cosign: false positive verification</p> https://cve.radiocsirt.org/vuln/rhsa-2022:8827