GHSA-vjxv-45g9-9296

Source
https://github.com/advisories/GHSA-vjxv-45g9-9296
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-vjxv-45g9-9296/GHSA-vjxv-45g9-9296.json
Aliases
Published
2022-08-10T18:40:38Z
Modified
2023-12-06T01:02:25.319480Z
Details

cosign verify-attestation used with the --type flag will report a false positive verification when:

  • There is at least one attestation with a valid signature
  • There are NO attestations of the type being verified (--type defaults to "custom")

This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.

References

Affected packages

Go / github.com/sigstore/cosign

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.10.1