Описание
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| cosign | fixed | 2.6.3-1 | package | |
| golang-github-sigstore-cosign-v2 | fixed | 2.6.3-2 | package |
Примечания
https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6
Fixed by: https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f (v3.0.6)
Fixed by: https://github.com/sigstore/cosign/commit/fecddd3c22045a39f52392e71e79f66854b41352 (v2.6.3)
Связанные уязвимости
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
A flaw was found in Cosign, a tool for code signing and transparency for containers and binaries. A remote attacker could exploit this vulnerability by providing malformed payloads or attestations with mismatched predicate types. This could lead to Cosign erroneously reporting a "Verified OK" result, even when the attestations are invalid. This issue compromises the integrity of the verification process, potentially allowing unverified software to be trusted.
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
Cosign's verify-blob-attestation reports false positive when payload parsing fails