Detections
Analytics
Alpine: multiple cosign packages: security update to 1.12.1-r0
medium Tenable Self-Hosted Container Security Plugin ID 403909
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Cosign is a project under the sigstore organization which aims to make signatures invisible
infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-
blob, where Cosign would successfully verify an artifact when verification should have failed. First a
cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not
reference the given signature. Second, when providing identity flags, the email and issuer of a
certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never
checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful
verification. And fourth an invalid transparency log entry will result in immediate success for
verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked.
Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues. (CVE-2022-36056)
See Also
Plugin Details
Severity: Medium
ID: 403909
Version: Revision 1.28
Type: Local
Published: 10/31/2023
Updated: 6/1/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.71
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2022-36056
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/14/2022
Reference Information
CVE: CVE-2022-36056