Executive brief
Denial of service attack from remote registry in github.com/sigstore/cosign
Affected products
- Go github.com/sigstore/cosign
- Go github.com/sigstore/cosign/v2
Junglewise Threat Intelligence
CVE-2023-46737: GO-2023-2181 - Denial of service attack from remote registry in github.com/sigstore/cosign
CVE-2023-46737 · Severity: low · CVSS 3.1 · Published 2023-11-09
Technologies: github.com/sigstore/cosign (Go), github.com/sigstore/cosign/v2 (Go). Vendors: Go.
Related threats
- Sigstore Cosign validation bypass in verify-blob-attestation
- GO-2026-4529 - Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto
- GO-2026-4309 - Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
- GO-2024-2719 - Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign
- GO-2024-2718 - Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign