{"id":"CVE-2022-36056","published":"2022-09-14T19:50:09Z","modified":"2025-04-22T17:21:40Z","title":"Vulnerabilities with blob verification in sigstore cosign","vendor":"sigstore","product":"cosign","tier":"tail","description":{"text":"Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First a cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature. Second, when providing identity flags, the email and issuer of a certificate is not checked when verifying a Rekor bundle, and the GitHub Actions identity is never checked. Third, providing an invalid Rekor bundle without the experimental flag results in a successful verification. And fourth an invalid transparency log entry will result in immediate success for verification. Details and examples of these issues can be seen in the GHSA-8gw7-4j42-w388 advisory linked. Users are advised to upgrade to 1.12.0. There are no known workarounds for these issues.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0015,"percentile":0.04168,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25","tags":["x_refsource_MISC"]}],"priority":{"score":4.7,"factors":[{"name":"EPSS percentile","points":0.83},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"sigstore","affectedVersions":[{"vendor":"sigstore","product":"cosign","versions":["< 1.12.0"]}],"affected":[{"ecosystem":"Go","package":"github.com/sigstore/cosign","vulnerableRanges":["<1.12.0"],"patched":["1.12.0"],"from":["GHSA-8gw7-4j42-w388","GO-2022-0998"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6744","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sigstore-cosign-cve-2022-23649","parents":[{"from":"CVE-2022-23649","to":"CVE-2022-36056","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/cosign/verify.go"],"commits":["https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49","https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-23649","published":"2022-02-18","fixed":"1.5.2","kev":false},{"cve":"CVE-2022-35929","published":"2022-08-04","fixed":"1.10.1","kev":false,"link":{"from":"CVE-2022-35929","to":"CVE-2022-36056","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/sigstore/cosign","fromFixed":"1.10.1","toFixed":"1.12.0","daysApart":41}]}},{"cve":"CVE-2022-36056","published":"2022-09-14","fixed":"1.12.0","kev":false},{"cve":"CVE-2023-46737","published":"2023-11-07","fixed":"1.13.2","kev":false,"link":{"from":"CVE-2022-36056","to":"CVE-2023-46737","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/sigstore/cosign","fromFixed":"1.12.0","toFixed":"1.13.2","daysApart":419}]}},{"cve":"CVE-2026-24122","published":"2026-02-19","fixed":"3.0.5","kev":false},{"cve":"CVE-2026-39395","published":"2026-04-07","fixed":"3.0.6","kev":false}],"package":"Go:github.com/sigstore/cosign"}}