Vulnerability · Published Aug 4, 2022 · Assigned by GitHub_M
CVE-2022-35929False positive signature verification in cosign
High 7.1
In plain English
A high-severity security flaw in cosign from sigstore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. This vulnerability can be reproduced with the `distroless.dev/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2` image. This image has a `vuln` attestation but not an `spdx` attestation. However, if you run `cosign verify-attestation --type=spdx` on this image, it incorrectly succeeds. This issue has been addressed in version 1.10.1 of cosign. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | cosign | 1.10.1-r0 | ALPINE-CVE-2022-35929 |
| Alpine:v3.21 | cosign | 1.10.1-r0 | ALPINE-CVE-2022-35929 |
| Alpine:v3.22 | cosign | 1.10.1-r0 | ALPINE-CVE-2022-35929 |
| Alpine:v3.23 | cosign | 1.10.1-r0 | ALPINE-CVE-2022-35929 |
| Alpine:v3.24 | cosign | 1.10.1-r0 | ALPINE-CVE-2022-35929 |
| Go | github.com/sigstore/cosign | 1.10.1 | GHSA-vjxv-45g9-9296 |
| Go | github.com/sigstore/cosign | 1.10.1 | GO-2022-0758 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H