Executive brief
Improper certificate validation in github.com/sigstore/cosign
Affected products
- Go github.com/sigstore/cosign
Junglewise Threat Intelligence
CVE-2022-23649: GO-2022-0326 - Improper certificate validation in github.com/sigstore/cosign
CVE-2022-23649 · Severity: low · CVSS 3.1 · Published 2023-11-09
Technologies: github.com/sigstore/cosign (Go). Vendors: Go.
Related threats
- Sigstore Cosign validation bypass in verify-blob-attestation
- GO-2026-4529 - Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto
- GO-2026-4309 - Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
- GO-2024-2719 - Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign
- GO-2024-2718 - Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign