Database/Container, Kubernetes & orchestration
cosign / sigstore: Cosign can be tricked into claiming a Rekor transparency-log entry exists when it does not
CVE-2022-23649Container, Kubernetes & orchestrationcurated
Impact
Cosign can be tricked into claiming a Rekor transparency-log entry exists when it does not
Who can reach it
Malicious image with a crafted signature
What to do
Upgrade cosign in the admission and CI paths
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.