Vulnerability Report: GO-2022-0998

Affected Packages

• Path
  Versions
  Symbols
• github.com/sigstore/cosign/cmd/cosign/cli/verify
  before v1.12.0
  • VerifyAttestationCommand.Exec
  • VerifyBlobCmd
  • VerifyCommand.Exec
• github.com/sigstore/cosign/pkg/cosign
  before v1.12.0
  10 affected symbols

  • TLogUpload
  • TLogUploadInTotoAttestation
  • VerifyBundle
  • VerifyImageAttestations
  • VerifyImageSignature
  • VerifyImageSignatures
  • VerifyLocalImageAttestations
  • VerifyLocalImageSignatures
  • VerifySET
  • VerifyTLogEntry

Aliases

• CVE-2022-36056
• GHSA-8gw7-4j42-w388

References

• https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388
• https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25
• https://github.com/sigstore/cosign/releases/tag/v1.12.0
• https://vuln.go.dev/ID/GO-2022-0998.json

Feedback