Cosign up to 1.11.x Artifact Verification signature verification

Summaryinfo

A vulnerability identified as problematic has been detected in Cosign up to 1.11.x. Affected by this vulnerability is an unknown functionality of the component Artifact Verification. The manipulation leads to signature verification. This vulnerability is uniquely identified as CVE-2022-36056. Local access is required to approach this attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cosign up to 1.11.x. It has been rated as problematic. This issue affects some unknown functionality of the component Artifact Verification. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is integrity, and availability. The summary by CVE is:

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.

The weakness was disclosed 09/15/2022 as GHSA-8gw7-4j42-w388. The advisory is shared at github.com. The identification of this vulnerability is CVE-2022-36056 since 07/15/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.12.0 eliminates this vulnerability. Applying the patch 80b79ed8b4d28ccbce3d279fd273606b5cddcc25 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Cosign

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion