Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/35527?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "type": "deb", "namespace": "debian", "name": "cosign", "version": "2.5.0-2", "qualifiers": { "distro": "trixie" }, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.6.2-1", "latest_non_vulnerable_version": "3.0.6-1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/26782?format=api", "vulnerability_id": "VCID-9npm-txna-eba4", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22703.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22703.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22703", "reference_id": "", "reference_type": "", "scores": [ { "value": "6e-05", "scoring_system": "epss", "scoring_elements": "0.00411", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22703" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126764", "reference_id": "1126764", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126764" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428445", "reference_id": "2428445", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428445" }, { "reference_url": "https://github.com/sigstore/cosign/pull/4623", "reference_id": "4623", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-12T16:43:50Z/" } ], "url": "https://github.com/sigstore/cosign/pull/4623" }, { "reference_url": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176", "reference_id": "6832fba4928c1ad69400235bbc41212de5006176", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-12T16:43:50Z/" } ], "url": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m", "reference_id": "GHSA-whqx-f9j3-ch6m", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-12T16:43:50Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35533?format=api", "purl": "pkg:deb/debian/cosign@2.6.2-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.6.2-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-22703", "GHSA-whqx-f9j3-ch6m" ], "risk_score": 2.5, "exploitability": "0.5", "weighted_severity": "5.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9npm-txna-eba4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27362?format=api", "vulnerability_id": "VCID-q7fe-g1ra-jkg9", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24122.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24122.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24122", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01466", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24122" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128652", "reference_id": "1128652", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128652" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441194", "reference_id": "2441194", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441194" }, { "reference_url": "https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e", "reference_id": "3c9a7363f563db76d78e2de2cabd945450f3781e", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T15:27:28Z/" } ], "url": "https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm", "reference_id": "GHSA-wfqv-66vq-46rm", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T15:27:28Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v3.0.5", "reference_id": "v3.0.5", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-20T15:27:28Z/" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v3.0.5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-24122", "GHSA-wfqv-66vq-46rm" ], "risk_score": 1.6, "exploitability": "0.5", "weighted_severity": "3.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q7fe-g1ra-jkg9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28485?format=api", "vulnerability_id": "VCID-vu3d-n74c-5qgu", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-39395.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-39395.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-39395", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00042", "scoring_system": "epss", "scoring_elements": "0.13087", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-39395" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39395", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39395" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133005", "reference_id": "1133005", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133005" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456254", "reference_id": "2456254", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456254" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6", "reference_id": "GHSA-w6c6-c85g-mmv6", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-08T15:49:08Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35535?format=api", "purl": "pkg:deb/debian/cosign@2.6.3-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.6.3-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-39395", "GHSA-w6c6-c85g-mmv6" ], "risk_score": 1.9, "exploitability": "0.5", "weighted_severity": "3.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vu3d-n74c-5qgu" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/16015?format=api", "vulnerability_id": "VCID-29sv-ze7t-mubk", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46737.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-46737.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-46737", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0031", "scoring_system": "epss", "scoring_elements": "0.54578", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-46737" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://github.com/sigstore/cosign/pull/3364", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign/pull/3364" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v1.13.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v1.13.2" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v2.2.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v2.2.1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46737", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46737" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248969", "reference_id": "2248969", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248969" }, { "reference_url": "https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f", "reference_id": "8ac891ff0e29ddc67965423bee8f826219c6eb0f", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-04T15:16:05Z/" } ], "url": "https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9", "reference_id": "GHSA-vfp6-jrw2-99g9", "reference_type": "", "scores": [ { "value": "3.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-04T15:16:05Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2023-46737", "GHSA-vfp6-jrw2-99g9" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-29sv-ze7t-mubk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12190?format=api", "vulnerability_id": "VCID-2my7-vaug-e3bk", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-35929.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-35929.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-35929", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0018", "scoring_system": "epss", "scoring_elements": "0.39475", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-35929" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35929", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35929" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116258", "reference_id": "2116258", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2116258" }, { "reference_url": "https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94", "reference_id": "c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:42:35Z/" } ], "url": "https://github.com/sigstore/cosign/commit/c5fda01a8ff33ca981f45a9f13e7fb6bd2080b94" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296", "reference_id": "GHSA-vjxv-45g9-9296", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:42:35Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-vjxv-45g9-9296" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2022-35929", "GHSA-vjxv-45g9-9296" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2my7-vaug-e3bk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19007?format=api", "vulnerability_id": "VCID-a9ev-tnf2-9fg3", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29903.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29903.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-29903", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00717", "scoring_system": "epss", "scoring_elements": "0.7285", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-29903" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29903", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29903" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274504", "reference_id": "2274504", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274504" }, { "reference_url": "https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e", "reference_id": "629f5f8fa672973503edde75f84dcd984637629e", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T15:22:56Z/" } ], "url": "https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv", "reference_id": "GHSA-95pr-fxf5-86gv", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T15:22:56Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4836", "reference_id": "RHSA-2024:4836", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4836" }, { "reference_url": "https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70", "reference_id": "signatures.go#L56-L70", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T15:22:56Z/" } ], "url": "https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v2.2.4", "reference_id": "v2.2.4", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T15:22:56Z/" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v2.2.4" }, { "reference_url": "https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955", "reference_id": "verify.go#L948-L955", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T15:22:56Z/" } ], "url": "https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2024-29903", "GHSA-95pr-fxf5-86gv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a9ev-tnf2-9fg3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11548?format=api", "vulnerability_id": "VCID-agz9-5umf-ayhs", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23649", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00024", "scoring_system": "epss", "scoring_elements": "0.06986", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23649" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v1.5.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v1.5.2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23649", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23649" }, { "reference_url": "https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49", "reference_id": "96d410a6580e4e81d24d112a0855c70ca3fb5b49", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:10:15Z/" } ], "url": "https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-ccxc-vr6p-4858", "reference_id": "GHSA-ccxc-vr6p-4858", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:10:15Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-ccxc-vr6p-4858" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2022-23649", "GHSA-ccxc-vr6p-4858" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-agz9-5umf-ayhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19006?format=api", "vulnerability_id": "VCID-jawh-ptng-pfbw", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29902.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-29902.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-29902", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0021", "scoring_system": "epss", "scoring_elements": "0.43464", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-29902" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29902", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29902" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274508", "reference_id": "2274508", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274508" }, { "reference_url": "https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e", "reference_id": "629f5f8fa672973503edde75f84dcd984637629e", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-03T14:13:43Z/" } ], "url": "https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc", "reference_id": "GHSA-88jx-383q-w4qc", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-03T14:13:43Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc" }, { "reference_url": "https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40", "reference_id": "layer.go#L36-L40", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-03T14:13:43Z/" } ], "url": "https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40" }, { "reference_url": "https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239", "reference_id": "remote.go#L228-L239", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-03T14:13:43Z/" } ], "url": "https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:4836", "reference_id": "RHSA-2024:4836", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:4836" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v2.2.4", "reference_id": "v2.2.4", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-03T14:13:43Z/" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v2.2.4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2024-29902", "GHSA-88jx-383q-w4qc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jawh-ptng-pfbw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/166897?format=api", "vulnerability_id": "VCID-rkeu-vpfc-bqcq", "summary": "Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36056.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-36056.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36056", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0002", "scoring_system": "epss", "scoring_elements": "0.05913", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-36056" }, { "reference_url": "https://github.com/sigstore/cosign", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign" }, { "reference_url": "https://github.com/sigstore/cosign/releases/tag/v1.12.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sigstore/cosign/releases/tag/v1.12.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36056", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36056" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128820", "reference_id": "2128820", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128820" }, { "reference_url": "https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25", "reference_id": "80b79ed8b4d28ccbce3d279fd273606b5cddcc25", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:44:20Z/" } ], "url": "https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25" }, { "reference_url": "https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388", "reference_id": "GHSA-8gw7-4j42-w388", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:44:20Z/" } ], "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8827", "reference_id": "RHSA-2022:8827", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8827" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35525?format=api", "purl": "pkg:deb/debian/cosign@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35527?format=api", "purl": "pkg:deb/debian/cosign@2.5.0-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9npm-txna-eba4" }, { "vulnerability": "VCID-q7fe-g1ra-jkg9" }, { "vulnerability": "VCID-vu3d-n74c-5qgu" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/35523?format=api", "purl": "pkg:deb/debian/cosign@3.0.6-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@3.0.6-1%3Fdistro=trixie" } ], "aliases": [ "CVE-2022-36056", "GHSA-8gw7-4j42-w388" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rkeu-vpfc-bqcq" } ], "risk_score": "2.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/cosign@2.5.0-2%3Fdistro=trixie" }