CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29903 – Cosign vulnerable to machine-wide denial of service via malicious artifacts
https://notcve.org/view.php?id=CVE-2024-29903
Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. • https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955 https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70 https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e https://github.com/sigstore/cosign/releases/tag/v2.2.4 https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv https://access.redhat.com/security/cve/CVE-2024-29903 https://bugzilla.redhat.com/ • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29902 – Cosign vulnerable to system-wide denial of service via malicious attachments
https://notcve.org/view.php?id=CVE-2024-29902
Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. • https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239 https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e https://github.com/sigstore/cosign/releases/tag/v2.2.4 https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc https://access.redhat.com/security/cve/CVE-2024-29902 https://bugzilla.r • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46737 – Possible endless data attack from attacker-controlled registry in cosign
https://notcve.org/view.php?id=CVE-2023-46737
Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is that Cosign loops through all attestations fetched from the remote registry in pkg/cosign.FetchAttestations. The attacker needs to compromise the registry or make a request to a registry they control. • https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9 • CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 1%CPEs: 13EXPL: 1CVE-2007-2233 – Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass
https://notcve.org/view.php?id=CVE-2007-2233
cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username. En el cosign-bin/cosign.cgi en Cosign versión 2.0.2 y anteriores permite a los usuarios autenticados remotos realizar acciones no autorizadas como un usuario arbitrario mediante el uso de secuencias CR (\r) en el parámetro service para inyectar los comandos LOGIN y REGISTER con el nombre de usuario deseado. • https://www.exploit-db.com/exploits/29844 http://secunia.com/advisories/24845 http://www.securityfocus.com/archive/1/465386/100/100/threaded http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt http://www.vupen.com/english/advisories/2007/1359 •
CVSS: 7.5EPSS: 4%CPEs: 12EXPL: 1CVE-2007-2232 – Cosign 2.0.1/2.9.4a - CGI Check Cookie Command Remote Authentication Bypass
https://notcve.org/view.php?id=CVE-2007-2232
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter. El comando CHECK en Cosign 2.0.1 y anterioes permite a atacantes remotos evitar requisitos de validación a través de la secuencia CR (\r) en el parámetro de la cookie cosign. • https://www.exploit-db.com/exploits/29842 http://secunia.com/advisories/24845 http://www.securityfocus.com/archive/1/465386/100/100/threaded http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-001.txt http://www.vupen.com/english/advisories/2007/1359 •