Cosign vulnerable to system-wide denial of service via malicious attachments
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sigstore | cosign | before 2.2.4 | 2.2.4 | Patch available | CNA |
| — | github.com/sigstore/cosign (Go) | up to 2.2.3 | — | No fix listed | GHSA-88jx-383q-w4qc |
| — | github.com/sigstore/cosign/v2 (Go) | before 2.2.4 | 2.2.4 | Patch available | GHSA-88jx-383q-w4qc |
- cosign Vendorsigstore Affected before 2.2.4 Fixed in 2.2.4 Patch available CNA
- github.com/sigstore/cosign (Go) Vendor— Affected up to 2.2.3 Fixed in — No fix listed GHSA-88jx-383q-w4qc
- github.com/sigstore/cosign/v2 (Go) Vendor— Affected before 2.2.4 Fixed in 2.2.4 Patch available GHSA-88jx-383q-w4qc
Remediation
- Fix · CNA cosign (sigstore) Fixed in 2.2.4
- Fix · GHSA-88jx-383q-w4qc github.com/sigstore/cosign/v2 (Go) Fixed in 2.2.4 Advisory →
Red Hat 1 advisory
- RHSA-2024:4836 Released 2024-07-24 · Red Hat rating ModerateRHACS 4.5 enhancement and security update
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines version 1.15 for RHEL 8 | Fixed | — |
| RHACS 4.5 for RHEL 8 | Fixed | RHSA-2024:4836 |
Not affected: 1 product
- Red Hat Advanced Cluster Security 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29902
- 2026-10-03 Alias added: GHSA-88jx-383q-w4qc
- 2026-10-09 EPSS moved to the 50th–90th percentile
References
Advisory 2
Other 4
- https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40
- https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239
- https://github.com/sigstore/cosign/releases/tag/v2.2.4
- https://github.com/sigstore/cosign
More sigstore Cosign vulnerabilities
- TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
- TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
- TI-2022-16479 Vulnerabilities with blob verification in sigstore cosign CVSS 3.1MEDIUM 5.5
- TI-2023-25220 Possible endless data attack from attacker-controlled registry in cosign CVSS 3.1MEDIUM 5.3
- TI-2026-28380 Cosign's verify-blob-attestation reports false positive when payload parsing fails CVSS 3.1MEDIUM 5.3
- TI-2026-18230 Cosign verification accepts any valid Rekor entry under certain conditions CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-29902 · CVE Program
- CVE-2024-29902 · NVD
- FIRST EPSS
- GHSA-88jx-383q-w4qc · GitHub Advisory Database · CC BY 4.0
- CVE-2024-29902 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences