cosign vulnerabilities

2 known vulnerabilities in cosign from Sigstore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  cosign: Allocation of Resources Without Limits or Throttling

  CVE-2024-29903Apr 10, 2024Sigstore

  Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is

• 9.8 Critical severity

  cosign: Improper Verification of Cryptographic Signature

  CVE-2022-35929Aug 4, 2022Sigstore

  cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at