Sigstore Cosign vulnerabilities
- sigstore cosign Cosign's verify-blob-attestation reports false positive when payload parsing fails 4.3 Medium
- sigstore cosign Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked 3.7 Low
- sigstore cosign Cosign verification accepts any valid Rekor entry under certain conditions 5.5 Medium
- sigstore cosign Cosign vulnerable to machine-wide denial of service via malicious artifacts 4.2 Medium
- sigstore cosign Cosign vulnerable to system-wide denial of service via malicious attachments 4.2 Medium
- sigstore cosign Possible endless data attack from attacker-controlled registry in cosign 3.1 Low
- sigstore cosign Vulnerabilities with blob verification in sigstore cosign 5.5 Medium
- sigstore cosign False positive signature verification in cosign 7.1 High
- sigstore cosign Improper Certificate Validation in Cosign 3.3 Low