sigstore/cosign · Security
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
- GHSA ID
- GHSA-vjxv-45g9-9296
- CVE ID
- CVE-2022-35929
- Severity
- high
- Published
- Updated
- CVSS
- 7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Description
cosign verify-attestation used with the --type flag will report a false positive verification when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
CWEs
- CWE-347 · Improper Verification of Cryptographic Signature