Executive brief
Improper verification of signature attestations in github.com/sigstore/cosign
Affected products
- Go github.com/sigstore/cosign
Junglewise Threat Intelligence
CVE-2022-35929: GO-2022-0758 - Improper verification of signature attestations in github.com/sigstore/cosign
CVE-2022-35929 · Severity: low · CVSS 3.1 · Published 2023-11-09
Technologies: github.com/sigstore/cosign (Go). Vendors: Go.
Related threats
- Sigstore Cosign validation bypass in verify-blob-attestation
- GO-2026-4529 - Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto
- GO-2026-4309 - Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
- GO-2024-2719 - Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign
- GO-2024-2718 - Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign