Detections
Analytics

SCA: security update for github.com/sigstore/cosign/v2 (GHSA-88jx-383q-w4qc)

medium Tenable Cloud Security Plugin ID 412548

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a
 remote image with a malicious attachment can cause denial of service of the host machine running Cosign.
 This can impact other services on the machine that rely on having memory available such as a Redis
 database which can result in data loss. It can also impact the availability of other services on the
 machine that will not be available for the duration of the machine denial. The root cause of this issue is
 that Cosign reads the attachment from a remote image entirely into memory without checking the size of the
 attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the
 attachments size is larger than the machine has memory available, the machine will be denied of service.
 The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a
 supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a
 registry or the account of an image vendor, they can include a malicious attachment and hurt the image
 consumer. Version 2.2.4 contains a patch for the vulnerability. (CVE-2024-29902)

See Also

https://github.com/advisories/GHSA-88jx-383q-w4qc

Plugin Details

Severity: Medium

ID: 412548

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.9

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-29902

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/11/2024

Vulnerability Publication Date: 4/10/2024

Reference Information

CVE: CVE-2024-29902

cwe: CWE-770