id: GO-2022-0326
modules:
    - module: github.com/sigstore/cosign
      versions:
        - fixed: 1.5.2
      vulnerable_at: 1.5.1
      packages:
        - package: github.com/sigstore/cosign/pkg/cosign
          symbols:
            - VerifyBundle
          derived_symbols:
            - VerifyImageAttestations
            - VerifyImageSignature
            - VerifyImageSignatures
            - VerifyLocalImageAttestations
            - VerifyLocalImageSignatures
        - package: github.com/sigstore/cosign/pkg/sget
          symbols:
            - SecureGet.Do
        - package: github.com/sigstore/cosign/cmd/cosign/cli/verify
          symbols:
            - VerifyAttestationCommand.Exec
            - VerifyCommand.Exec
            - PrintVerificationHeader
summary: Improper certificate validation in github.com/sigstore/cosign
description: |-
    Cosign can be manipulated to claim that an entry for a signature in the OCI
    registry exists in the Rekor transparency log even if it does not. This requires
    the attacker to have pull and push permissions for the signature in OCI. This
    can happen with both standard signing with a keypair and "keyless signing" with
    Fulcio certificate authority.
cves:
    - CVE-2022-23649
ghsas:
    - GHSA-ccxc-vr6p-4858
references:
    - fix: https://github.com/sigstore/cosign/commit/96d410a6580e4e81d24d112a0855c70ca3fb5b49
    - web: https://github.com/sigstore/cosign/releases/tag/v1.5.2
review_status: REVIEWED