Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cosign is a project under the sigstore organization which aims to make signatures invisible
    infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-
    blob, where Cosign would successfully verify an artifact when verification should have failed. First a
    cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not
    reference the given signature. Second, when providing identity flags, the email and issuer of a
    certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never
    checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful
    verification. And fourth an invalid transparency log entry will result in immediate success for
    verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked.
    Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues. (CVE-2022-36056)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3486-1 advisory.

    Updated to version 1.12.0 (jsc#SLE-23879):
    - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have     failed (bsc#1203430).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412672	SCA: security update for github.com/sigstore/cosign (GHSA-8gw7-4j42-w388)	Tenable Cloud Security	SCA Checks	medium
412672	SCA: security update for github.com/sigstore/cosign (GHSA-8gw7-4j42-w388)	Tenable Self-Hosted Container Security	SCA Checks	medium
403909	Alpine: multiple cosign packages: security update to 1.12.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
403909	Alpine: multiple cosign packages: security update to 1.12.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
165617	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2022:3486-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2022-36056

medium

Tenable Plugins

medium

medium

medium

medium

medium