GHSA-vjxv-45g9-9296HighCVSS 7.1

cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists

Published
August 10, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-35929 →

📋 Description

cosign verify-attestation used with the --type flag will report a false positive verification when:

  • There is at least one attestation with a valid signature
  • There are NO attestations of the type being verified (--type defaults to "custom")

This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.

🎯 Affected products1

  • go/github.com/sigstore/cosign:< 1.10.1

🔗 References (4)