Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-9yxy-m6af-7bdd
|
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists
`cosign verify-attestation` used with the `--type` flag will report a false positive verification when:
- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")
This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
|
CVE-2022-35929
GHSA-vjxv-45g9-9296
|