https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:23:41 +0000 https://cve.radiocsirt.org/vuln/bit-cosign-2024-29902 <p><strong>Affected:</strong> Bitnami: cosign</p> <p>Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.</p> <p><strong>Affected:</strong> Bitnami: cosign</p> <p>Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.</p> https://cve.radiocsirt.org/vuln/bit-cosign-2024-29902 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/euvd-2026-4696 EUVD-2026-4696 https://cve.radiocsirt.org/vuln/euvd-2026-4696 https://cve.radiocsirt.org/vuln/fkie_cve-2024-29902 <p>Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.</p> <p>Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-29902 https://cve.radiocsirt.org/vuln/ghsa-88jx-383q-w4qc <p><strong>Affected:</strong> Go: github.com/sigstore/cosign, Go: github.com/sigstore/cosign/v2</p> <p>### Summary A remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial.</p> <p>### Details The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a `SIGKILL` after a few seconds of system-wide denial.</p> <p>The root cause is that Cosign reads the contents of the attachments entirely into memory on line 238 below:</p> <p>https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239</p> <p>...and prior to that, neither Cosign nor go-containerregistry checks the size of the attachment and enforces a max cap. In the case of a remote layer of `f *attached`, go-containerregistry will invoke this API:</p> <p>https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 ```golang func (rl *remoteLayer) Compressed() (io.ReadCloser, error) { // We don&#39;t want to log bin…</p> <p><strong>Affected:</strong> Go: github.com/sigstore/cosign, Go: github.com/sigstore/cosign/v2</p> <p>### Summary A remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial.</p> <p>### Details The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a `SIGKILL` after a few seconds of system-wide denial.</p> <p>The root cause is that Cosign reads the contents of the attachments entirely into memory on line 238 below:</p> <p>https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239</p> <p>...and prior to that, neither Cosign nor go-containerregistry checks the size of the attachment and enforces a max cap. In the case of a remote layer of `f *attached`, go-containerregistry will invoke this API:</p> <p>https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 ```golang func (rl *remoteLayer) Compressed() (io.ReadCloser, error) { // We don&#39;t want to log bin…</p> https://cve.radiocsirt.org/vuln/ghsa-88jx-383q-w4qc https://cve.radiocsirt.org/vuln/gsd-2024-29902 gsd-2024-29902 https://cve.radiocsirt.org/vuln/gsd-2024-29902 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13863-1 <p>cosign-2.2.4-1.1 on GA media</p> <p>cosign-2.2.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13863-1 https://cve.radiocsirt.org/vuln/rhea-2024:4022 <p>golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose-go: improper handling of highly compressed data cosign: Malicious attachments can cause system-wide denial of service cosign: Malicious artifects can cause machine-wide denial of service</p> <p>golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose-go: improper handling of highly compressed data cosign: Malicious attachments can cause system-wide denial of service cosign: Malicious artifects can cause machine-wide denial of service</p> https://cve.radiocsirt.org/vuln/rhea-2024:4022 https://cve.radiocsirt.org/vuln/suse-su-2024:1486-1 <p>Security update for cosign</p> <p>Security update for cosign</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1486-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1707 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Security for Kubernetes ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Security for Kubernetes ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1707