Security Advisories for github.com/sigstore/cosign in go
Moderate
7 months ago
Cosign's verify-blob-attestation reports false positive when payload parsing fails
go
github.com/sigstore/cosign
Low
8 months ago
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
go
github.com/sigstore/cosign
Moderate
over 2 years ago
Cosign malicious artifacts can cause machine-wide DoS
go
github.com/sigstore/cosign/v2, github.com/sigstore/cosign
Moderate
over 2 years ago
Cosign malicious attachments can cause system-wide denial of service
go
github.com/sigstore/cosign/v2, github.com/sigstore/cosign
Low
almost 3 years ago
Cosign vulnerable to possible endless data attack from attacker-controlled registry
go
github.com/sigstore/cosign, github.com/sigstore/cosign/v2
Moderate
about 4 years ago
Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature
go
github.com/sigstore/cosign
High
about 4 years ago
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
go
github.com/sigstore/cosign