GO-2023-2181
Denial of service attack from remote registry in github.com/sigstore/cosign
At a glance
- Published
- Updated
- CVE
- CVE-2023-46737
- Aliases
- BIT-cosign-2023-46737, GHSA-vfp6-jrw2-99g9
Description
An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/sigstore/cosign | introduced 0 |
| Go · github.com/sigstore/cosign/v2 | introduced 0, fixed 2.2.1 |
References
- https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f FIX
- https://github.com/sigstore/cosign/releases/tag/v2.2.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |