Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-23649— Improper Certificate Validation in Cosign

Quick assessment

Affected
sigstore cosign
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cosign是美国的一个 Oci 注册表中的容器签名、验证和存储。 Cosign 1.5.2之前版本存在信任管理问题漏洞，攻击者可利用该漏洞访问OCI中的签名，操纵cosign。

CVSS 3.3 · Low EPSS 0.16% · P5
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-23649

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper Certificate Validation in Cosign
Source: CVE Program / CVE List V5
Vulnerability Description
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has access to the signature in OCI, they can manipulate cosign into believing the entry was stored in Rekor even though it wasn't. The vulnerability has been patched in v1.5.2 of Cosign. The `signature` in the `signedEntryTimestamp` provided by Rekor is now compared to the `signature` that is being verified. If these don't match, then an error is returned. If a valid bundle is copied to a different signature, verification should fail. Cosign output now only informs the user that certificates were verified if a certificate was in fact verified. There is currently no known workaround.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cosign 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cosign是美国的一个 Oci 注册表中的容器签名、验证和存储。 Cosign 1.5.2之前版本存在信任管理问题漏洞，攻击者可利用该漏洞访问OCI中的签名，操纵cosign。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
sigstore cosign < 1.5.2 -

II. Public POCs for CVE-2022-23649

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-23649

请登录查看更多情报信息。

Vendor Advisories for CVE-2022-23649 (1)

IV. Related Vulnerabilities

Same product: cosign
Same vendor: sigstore
Same weakness: CWE-295

V. Comments for CVE-2022-23649

No comments yet

Leave a comment