| id: GO-2022-0998 |
| modules: |
| - module: github.com/sigstore/cosign |
| versions: |
| - fixed: 1.12.0 |
| vulnerable_at: 1.11.1 |
| packages: |
| - package: github.com/sigstore/cosign/cmd/cosign/cli/verify |
| symbols: |
| - VerifyBlobCmd |
| - verifySigByUUID |
| - signatures |
| - verifyRekorEntry |
| - verifyRekorBundle |
| derived_symbols: |
| - VerifyAttestationCommand.Exec |
| - VerifyCommand.Exec |
| - package: github.com/sigstore/cosign/pkg/cosign |
| symbols: |
| - VerifySET |
| derived_symbols: |
| - TLogUpload |
| - TLogUploadInTotoAttestation |
| - VerifyBundle |
| - VerifyImageAttestations |
| - VerifyImageSignature |
| - VerifyImageSignatures |
| - VerifyLocalImageAttestations |
| - VerifyLocalImageSignatures |
| - VerifyTLogEntry |
| summary: Improper blob verification in github.com/sigstore/cosign |
| cves: |
| - CVE-2022-36056 |
| ghsas: |
| - GHSA-8gw7-4j42-w388 |
| references: |
| - advisory: https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388 |
| - fix: https://github.com/sigstore/cosign/commit/80b79ed8b4d28ccbce3d279fd273606b5cddcc25 |
| - web: https://github.com/sigstore/cosign/releases/tag/v1.12.0 |
