{"id":"CVE-2022-35929","aliases":["ALPINE-CVE-2022-35929","BIT-cosign-2022-35929","EUVD-2022-6632","GHSA-vjxv-45g9-9296","GO-2022-0758","SUSE-SU-2022:2877-1","openSUSE-SU-2024:12240-1"],"status":"published","title":"False positive signature verification in cosign","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00684,"percentile":0.52999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2022-08-04T18:45:14Z","modified":"2026-11-03T07:30:37Z","fixes":[{"ecosystem":"Go","package":"github.com/sigstore/cosign","fixed_in":["1.10.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cosign","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"cosign","fixed_in":["1.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"cosign","fixed_in":["1.10.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"cosign","fixed_in":["1.10.1-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cosign","fixed_in":["1.10.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/sigstore/cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"cosign","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/cosign","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/sigstore/cosign","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cosign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1.1"}]}]}],"products":[{"vendor":"sigstore","product":"cosign"}],"references":[{"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35929","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vjxv-45g9-9296"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-35929","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35929.json","tags":["advisory"]},{"url":"https://github.com/sigstore/cosign","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222877-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202157","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35929","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35929","title":"False positive signature verification in cosign","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-04T18:45:14Z","modified":"2025-04-22T17:43:02.289Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-6632","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-04T18:45:14Z","modified":"2025-04-22T17:43:02Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:15.540112Z"}],"ghsa":[{"id":"GHSA-vjxv-45g9-9296","title":"cosign's `cosign verify-attestaton  --type` can report a false positive if any attestation exists","description":"`cosign verify-attestation` used with the `--type` flag will report a false positive verification when:\n\n- There is at least one attestation with a valid signature\n- There are NO attestations of the type being verified (--type defaults to \"custom\")\n\nThis can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.","status":"published","published":"2022-08-10T18:40:38Z","modified":"2023-01-30T05:01:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:27.500048Z"}],"nvd":[{"id":"CVE-2022-35929","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-04T19:15:09.937Z","modified":"2026-06-17T04:52:32.657Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"ALPINE-CVE-2022-35929","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-04T19:15:09.937Z","modified":"2026-11-03T07:30:37.648742511Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-35929","title":"False positive signature verification in cosign","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-04T18:45:14Z","modified":"2026-10-28T02:31:03.502373016Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-vjxv-45g9-9296","title":"cosign's `cosign verify-attestaton  --type` can report a false positive if any attestation exists","description":"`cosign verify-attestation` used with the `--type` flag will report a false positive verification when:\n\n- There is at least one attestation with a valid signature\n- There are NO attestations of the type being verified (--type defaults to \"custom\")\n\nThis can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.","status":"published","published":"2022-08-10T18:40:38Z","modified":"2023-12-06T01:02:25.31948Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"BIT-cosign-2022-35929","title":"False positive signature verification in cosign","description":"cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to \"custom\"). This can happen when signing with a standard keypair and with \"keyless\" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2024-03-06T10:51:23.199Z","modified":"2026-09-08T08:46:02.349759433Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"GO-2022-0758","title":"Improper verification of signature attestations in github.com/sigstore/cosign","description":"Improper verification of signature attestations in github.com/sigstore/cosign","status":"published","published":"2023-11-09T17:47:03Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:12240-1","title":"cosign-1.10.1-1.1 on GA media","description":"These are all security issues fixed in the cosign-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:34:07.267398Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2877-1","title":"Security update for cosign","description":"This update for cosign fixes the following issues:\n\n- Updated to 1.10.1 (jsc#SLE-23879):\n  - CVE-2022-35929: Fixed an issue where cosign verify-attestation --type\n    could report false positives when there was at least one attestation\n    with a valid signature and there were no attestations of the type\n    being verified (bsc#1202157).\n","status":"published","published":"2022-08-23T11:31:27Z","modified":"2026-02-04T03:46:34.237559Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}