CVE-2022-35929
False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-35929- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2022-6632
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
EUVD-2022-6632- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vjxv-45g9-9296
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
cosign verify-attestation used with the --type flag will report a false positive verification when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
- Record
GHSA-vjxv-45g9-9296- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-35929- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-35929
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
ALPINE-CVE-2022-35929- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-35929- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-vjxv-45g9-9296
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
cosign verify-attestation used with the --type flag will report a false positive verification when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
- Record
GHSA-vjxv-45g9-9296- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVBIT-cosign-2022-35929 No score
False positive signature verification in cosign
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2 image. This image has a vuln attestation but not an spdx attestation. However, if you run cosign verify-attestation --type=spdx on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
BIT-cosign-2022-35929- Updated
- 2026-11-02
OSVGO-2022-0758 No score
Improper verification of signature attestations in github.com/sigstore/cosign
Improper verification of signature attestations in github.com/sigstore/cosign
- Record
GO-2022-0758- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12240-1 No score
cosign-1.10.1-1.1 on GA media
These are all security issues fixed in the cosign-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12240-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:2877-1 No score
Security update for cosign
This update for cosign fixes the following issues:
- Updated to 1.10.1 (jsc#SLE-23879):
- CVE-2022-35929: Fixed an issue where cosign verify-attestation --type could report false positives when there was at least one attestation with a valid signature and there were no attestations of the type being verified (bsc#1202157).
- Record
SUSE-SU-2022:2877-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/sigstore/cosignGo |
before 1.10.1 | 1.10.1 |
cosignAlpine:v3.16 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.17 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.18 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.19 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.20 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.21 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.22 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.23 |
before 1.10.1-r0 | 1.10.1-r0 |
cosignAlpine:v3.24 |
before 1.10.1-r0 | 1.10.1-r0 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cosignBitnami |
before 1.10.1 | 1.10.1 |
cosignSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 1.10.1-150400.3.3.1 | 1.10.1-150400.3.3.1 |
cosignopenSUSE:Leap 15.4 |
before 1.10.1-150400.3.3.1 | 1.10.1-150400.3.3.1 |
cosignopenSUSE:Tumbleweed |
before 1.10.1-1.1 | 1.10.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-35929 is a high vulnerability (CVSS 7.1) in Sigstore Cosign, published August 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in github.com/sigstore/cosign 1.10.1.
References
github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296
nvd.nist.gov/vuln/detail/CVE-2022-35929
security.alpinelinux.org/vuln/CVE-2022-35929