Sigstore vulnerabilities
40 CVEs and advisories name Sigstore as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-29903Cosign vulnerable to machine-wide denial of service via malicious artifacts
- CVE-2024-29902Cosign vulnerable to system-wide denial of service via malicious attachments
- CVE-2023-47122Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.
- CVE-2023-46737Possible endless data attack from attacker-controlled registry in cosign
- CVE-2023-33199malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
- CVE-2023-30551Rekor's compressed archives can result in OOM conditions
- CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign
- CVE-2022-35930Ability to bypass attestation verification in sigstore PolicyController
- CVE-2022-35929False positive signature verification in cosign
- CVE-2022-23649Improper Certificate Validation in Cosign