Read the docs

sigstore

Records40All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9

Exploited now

sigstore records in CISA KEV

No sigstore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cosign 9 records HIGH Sigstore-go 2 records LOW Gitsign 1 record LOW Policy Controller 1 record MEDIUM Sigstore 1 record LOW

Records

9 records in Cosign · all components

TI-2022-16356 CVE-2022-35929 · GHSA-vjxv-45g9-9296

False positive signature verification in cosign

Priority HIGH 76

cosign is a container signing and verification utility.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00684 Published 2022-08-04 Partial fix · 1.10.1 CWE-347
TI-2022-16479 CVE-2022-36056 · GHSA-8gw7-4j42-w388

Vulnerabilities with blob verification in sigstore cosign

Priority MEDIUM 58

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0015 Published 2022-09-14 Partial fix · 1.12.0 CWE-347
TI-2022-07701 CVE-2022-23649 · GHSA-ccxc-vr6p-4858

Improper Certificate Validation in Cosign

Priority LOW 15

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00163 Published 2022-02-18 Fixed in 1.5.2 CWE-295
Open these records in search →